feat(01-03): register ddhh_provider role with restricted capabilities

- Add DDHH_JM_Roles class with add_roles() and remove_roles() methods
- Role 'ddhh_provider' (Anbieter) can edit/delete own job_offers only
- Jobs go to pending status (publish_job_offers: false)
- No access to regular posts/pages (edit_posts/edit_pages: false)
- Can upload files for logos
- Integrated with Activator and Deactivator hooks

includes/class-activator.php

@@ -30,6 +30,9 @@ class DDHH_JM_Activator {
 		// Store plugin version
 		update_option( 'ddhh_jm_version', DDHH_JM_VERSION );
 
+		// Register custom roles
+		DDHH_JM_Roles::add_roles();
+
 		// Set flag to flush rewrite rules on next init
 		set_transient( 'ddhh_jm_flush_rewrite_rules', 1, 60 );
 	}

includes/class-deactivator.php

@@ -17,6 +17,9 @@ class DDHH_JM_Deactivator {
 	 * Deactivation logic
 	 */
 	public static function deactivate() {
+		// Remove custom roles
+		DDHH_JM_Roles::remove_roles();
+
 		// Flush rewrite rules
 		flush_rewrite_rules();
 	}

includes/class-roles.php

@@ -0,0 +1,62 @@
+<?php
+/**
+ * User roles handler
+ *
+ * @package DDHH_Job_Manager
+ */
+
+// Exit if accessed directly.
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Handles custom user roles
+ */
+class DDHH_JM_Roles {
+
+	/**
+	 * Add custom roles
+	 * Called on plugin activation
+	 */
+	public static function add_roles() {
+		// Register ddhh_provider role
+		add_role(
+			'ddhh_provider',
+			__( 'Anbieter', 'ddhh-job-manager' ),
+			array(
+				// Basic WordPress access
+				'read'                   => true,
+
+				// Job offer capabilities (own only)
+				'edit_job_offers'        => true,
+				'delete_job_offers'      => true,
+				'upload_files'           => true,
+
+				// Explicitly deny publishing (jobs go to pending for admin approval)
+				'publish_job_offers'     => false,
+
+				// Explicitly deny editing others' content
+				'edit_others_job_offers' => false,
+
+				// Explicitly deny access to regular posts/pages
+				'edit_posts'             => false,
+				'edit_pages'             => false,
+				'edit_others_posts'      => false,
+				'edit_others_pages'      => false,
+				'publish_posts'          => false,
+				'publish_pages'          => false,
+
+				// Explicitly deny admin functions
+				'manage_categories'      => false,
+				'manage_options'         => false,
+			)
+		);
+	}
+
+	/**
+	 * Remove custom roles
+	 * Called on plugin deactivation
+	 */
+	public static function remove_roles() {
+		remove_role( 'ddhh_provider' );
+	}
+}