-- Rol formularios_readonly: solo acceso a lab_formularios con permiso write
-- Permite crear y editar formularios; los envíos/resultados son solo lectura (UI)
UPDATE role_modules
SET permission = 'write'
WHERE role_id = (SELECT id FROM roles WHERE slug = 'formularios_readonly')
  AND module_slug = 'lab_formularios';

-- Eliminar acceso a lab_dashboard que no corresponde a este rol
DELETE FROM role_modules
WHERE role_id = (SELECT id FROM roles WHERE slug = 'formularios_readonly')
  AND module_slug = 'lab_dashboard';