refactor(role): use grant only

- remove permission centric mode
    - finalize migration drop all tables with permissions
    - ensure roles are ENUM (owner is always displayed first)

static/sw.js

@@ -1,6 +1,6 @@
 // OxiCloud Service Worker
 // FIXME: generate cache name according build ?
-const CACHE_NAME = 'oxicloud-cache-v27';
+const CACHE_NAME = 'oxicloud-cache-v28';
 
 // Only cache static assets — NOT HTML files.
 // HTML files are served network-first so browsers always get the latest