I have my security tables in the same database as my application files, added via the DDT and deployed to the SQL Server.
Then you do not need to set the SecurityDataSourceKey as the security key will reference your application database or default connection.
and i cant see my "live" users (created from within the SecuritDialog within my app) from within VS.
The first question is that did you deploy your users to your application database? By default this will be empty. Also, make sure you call the SecurityBasics.SetSecurityKeyAndVectorForUserAuthentication("yourPresharedKey") in the InitApplication otherwise you will not see any user. In fact, you will get an error.
This also brings me to another question, are security roles then only available for add/edit at design time, that doesn't seem right?
No. You cannot create permissions as run-time. This would not make sense since the end-users should not be able to create permissions. If the end-user created the permissions they would never be implemented within the code (or tested on by you the developer). They would just be "hollow" permissions that did not do anything.