Role-based access for fleet admins

Right now anyone with the account login can change QoS and filters for the whole airline. We need read-only vs admin roles, and ideally scoping an admin to specific tail numbers.