Add dedicated User Roles page (#789)

Create a standalone User Roles reference covering all six roles (Owner,
Admin, Network Admin, Billing Admin, Auditor, User) with a permission
matrix aligned to the current dashboard, per-role sections, API/token
notes, and role-assignment steps.

Reduce the role section on the Add Users page to a pointer (keeping the
existing anchor), repoint inbound links from delete-account,
control-center, and msp-portal, add the page to the Team sidebar, and
refresh the role screenshots.

src/components/NavigationDocs.jsx

@@ -314,6 +314,7 @@ export const docsNavigation = [
             title: 'Add Users to Your Network',
             href: '/manage/team/add-users-to-your-network',
           },
+          { title: 'User Roles', href: '/manage/team/user-roles' },
           { title: 'Approve Users', href: '/manage/team/approve-users' },
           {
             title: 'Enable NetBird for Entra ID',

src/pages/manage/control-center/index.mdx

@@ -12,7 +12,7 @@ Control Center is a topological view in the NetBird dashboard that visualizes wh
 </Note>
 <Note>
     **Permissions:** The Admin and Network Admin user roles can edit policies from Control Center. Learn more about
-    [user roles](/manage/team/add-users-to-your-network#manage-user-roles).
+    [user roles](/manage/team/user-roles).
 </Note>
 
 ## How it helps

src/pages/manage/for-partners/msp-portal.mdx

@@ -46,7 +46,7 @@ In the 'Tenants' section of your dashboard, click on the 'Add Tenant' button to
     <img src="/docs-static/img/manage/for-partners/msp-portal/add-new-tenant-name-domain.png" alt="add-new-tenant-name-domain" className="imagewrapper"/>
 </p>
 
-2. Define who can access the tenant account by selecting the user groups of your account and the applicable [user role](/manage/team/add-users-to-your-network#manage-user-roles) when they switch to the tenant. Only users from the selected groups will
+2. Define who can access the tenant account by selecting the user groups of your account and the applicable [user role](/manage/team/user-roles) when they switch to the tenant. Only users from the selected groups will
 be able to switch to and manage the tenant account.
 <p>
     <img src="/docs-static/img/manage/for-partners/msp-portal/add-new-tenant-permissions.png" alt="add-new-tenant-permissions" className="imagewrapper"/>

src/pages/manage/settings/delete-account.mdx

@@ -1,7 +1,7 @@
 import {Note} from "@/components/mdx";
 
 # Delete your NetBird account
-To delete your NetBird organization account, you must be a user with the [owner role](/manage/team/add-users-to-your-network#manage-user-roles). You can ask the owner to delete the organization account if you are not the account owner.
+To delete your NetBird organization account, you must be a user with the [owner role](/manage/team/user-roles#owner). You can ask the owner to delete the organization account if you are not the account owner.
 ## Delete your account
 <Note>
     Before proceeding to delete your Netbird account, please be aware that this action is irreversible. Once your account is deleted, you will permanently lose access to all associated data, including your peers, users, groups, policies, and routes.

src/pages/manage/team/add-users-to-your-network.mdx

@@ -60,43 +60,7 @@ button.
 See the [Provision Users and Groups From Your Identity Provider](/manage/team/idp-sync) section for more details.
 
 ## Manage user roles
-NetBird has five user roles - `Owner`, `Admin`, `Network Admin`, `Auditor` and `User`. The roles allow you to control the level of access to the management API of your account. 
-
-- `Owner` role - has full access to the account and can manage all aspects of the account. There can be only one account owner in NetBird. Users with the owner role can delete their organization account. See the [Delete NetBird account](/manage/settings/delete-account) section for more.
-- `Admin` role - has full access to the account except that administrators can't delete or update the role of the Owner user and delete the organization account.
-- `Network Admin` role - has access to manage network configurations, including access policies, DNS settings, networks, and network routes, but they can only view user and device information and general settings.
-- `Auditor` role - can read all configurations but not modify any of them.
-- `User` role - has limited access to the account, allowing users to view peers they own and others they can connect to. Users can create personal access tokens for programmatic access.
-
-|  | Owner | Admin | Network Admin | User | Auditor |
-| --: | :--: | :--: | :--: | :--: | :--: |
-| Peers | ✅ | ✅ | 📖 | 📖 | 📖 |
-| Setup Keys | ✅ | ✅ | 📖 | ❌ | 📖 |
-| Access Control | ✅ | ✅ | ✅ | ❌ | 📖 |
-| Networks | ✅ | ✅ | ✅ | ❌ | 📖 |
-| Network Routes | ✅ | ✅ | ✅ | ❌ | 📖 |
-| DNS | ✅ | ✅ | ✅ | ❌ | 📖 |
-| Team | ✅ | ✅ | 📖 | ❌ | 📖 |
-| Activity | ✅ | ✅ | 📖 | ❌ | 📖 |
-| Settings | ✅ | ✅ | 📖 | ❌ | 📖 |
-
-| |
-|-:|
-|✅ = Full access \| 📖 = Read only \| ❌ = No access|
-
-
-To manage user roles, proceed to the `Users` tab and click on the user you want to update:
-<p>
-  <img src="/docs-static/img/manage/team/user-tab-list.png" alt="high-level-dia" className="imagewrapper-big"/>
-</p>
-After that, select the desired role from the dropdown:
-<p>
-  <img src="/docs-static/img/manage/team/user-update-role.png" alt="high-level-dia" className="imagewrapper-big"/>
-</p>
-Click the `Save` button to save the changes.
-<Note>
-    Only users with the `Owner` role can assign another user as `Owner`; this action will transfer the `Owner` role to another user, making the current user `Admin`.
-</Note>
+NetBird user roles control the level of access each person has to your account. See [User Roles](/manage/team/user-roles) for what each role can access and how to assign them.
 
 ## Get started
 <div>

src/pages/manage/team/user-roles.mdx

@@ -0,0 +1,82 @@
+import {Note} from "@/components/mdx"
+
+export const description = "Understand NetBird's user roles — Owner, Admin, Network Admin, Billing Admin, Auditor, and User — what each can access, and how to assign them."
+
+# User Roles
+
+NetBird has six user roles - `Owner`, `Admin`, `Network Admin`, `Billing Admin`, `Auditor`, and `User`. A user's role controls the level of access they have to your account, both in the dashboard and through the management API.
+
+## Permissions at a glance
+
+Rows are grouped by what a `Network Admin` can do, from full access down to no access.
+
+| Area | Owner | Admin | Network Admin | Billing Admin | Auditor | User |
+| --: | :--: | :--: | :--: | :--: | :--: | :--: |
+| Control Center | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
+| Access Control | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
+| Network Routing | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
+| DNS | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
+| Peers | ✅ | ✅ | 📖 | ❌ | 📖 | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> |
+| Setup Keys | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
+| Team | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
+| Activity | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
+| Settings | ✅ | ✅ | 📖 | ✅<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> | 📖 | ❌ |
+| Reverse Proxy | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
+| Tenants | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
+| Integrations | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
+
+**Legend:** ✅ = Full access · 📖 = Read only · ❌ = No access
+
+<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> A `User` can only see the peers they own and peers they're allowed to connect to.
+
+<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> A `Billing Admin`'s Settings access is limited to **Plans & Billing** and **Invoices**.
+
+## Owner
+The `Owner` has full access to the account and can manage every aspect of it. There can be only one account owner in NetBird. Owners are the only users who can delete the organization account - see [Delete NetBird account](/manage/settings/delete-account) for more.
+
+## Admin
+An `Admin` has full access to the account, with two exceptions: administrators can't delete or change the role of the `Owner`, and they can't delete the organization account.
+
+## Network Admin
+A `Network Admin` fully manages network configuration - Control Center, Access Control, Network Routing, and DNS. They have read-only access to Peers, Setup Keys, Team, Activity, and Settings, and no access to Reverse Proxy, Tenants, or Integrations. A `Network Admin` can view setup keys but not create them, and can't invite users or create service users.
+
+## Billing Admin
+A `Billing Admin` manages billing only. They can access `Settings` → `Plans & Billing` and `Settings` → `Invoices`, and have no access to any other part of the account.
+
+## Auditor
+An `Auditor` can read every configuration in the account but can't modify anything.
+
+## User
+A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to.
+
+## Roles and the API
+Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role. Every role except `User` can create a personal access token that carries the same permissions as that user's role, so they can interact with the API programmatically.
+
+## Roles and identity provider sync
+<Note>
+    Roles are managed inside NetBird. When you provision users and groups from your identity provider, synced groups are only used for group membership and will not change a user's NetBird role.
+</Note>
+
+## Assign a role
+To change a user's role, go to the `Team` tab, select the `Users` tab, and click the user you want to update:
+<p>
+  <img src="/docs-static/img/manage/team/user-tab-list.png" alt="user list in the Team tab" className="imagewrapper-big"/>
+</p>
+Select the desired role from the dropdown:
+<p>
+  <img src="/docs-static/img/manage/team/user-update-role.png" alt="user role dropdown" className="imagewrapper-big"/>
+</p>
+Click the `Save` button to apply the change.
+<Note>
+    Only users with the `Owner` role can assign another user as `Owner`; this action transfers the `Owner` role to the other user, making the current user an `Admin`.
+</Note>
+
+## Get started
+<div>
+    <Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
+</div>
+
+- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
+- Follow us [on X](https://x.com/netbird)
+- Join our [Slack Channel](/slack-url)
+- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub