refactor(role): use grant only

- remove permission centric mode
    - finalize migration drop all tables with permissions
    - ensure roles are ENUM (owner is always displayed first)

src/domain/entities/share.rs

@@ -12,7 +12,7 @@ pub struct Share {
     item_type: ShareItemType,
     token: String,
     password_hash: Option<String>,
-    /// Derived from `storage.access_grants.expires_at` — not stored on the share row.
+    /// Derived from `storage.role_grants.expires_at` — not stored on the share row.
     expires_at: Option<u64>,
     created_at: u64,
     created_by: Uuid,

src/domain/entities/subject_group.rs

@@ -2,7 +2,7 @@
 //!
 //! Subject groups are root-owned (no `owner_id`), globally named with an
 //! RFC 5321 local-part shape, and able to contain users *or* other groups.
-//! Grants in `storage.access_grants` with `subject_type = 'group'` reference
+//! Grants in `storage.role_grants` with `subject_type = 'group'` reference
 //! a row in `auth.subject_groups`.
 //!
 //! Cycle prevention and depth-cap (`MAX_GROUP_DEPTH`) are enforced at the