ROB-523 docs: namespace-scoped RBAC guide (restore + how-it-works) (#2114)