refactor(role): use grant only

- remove permission centric mode
    - finalize migration drop all tables with permissions
    - ensure roles are ENUM (owner is always displayed first)

tests/api/subject_groups.hurl

@@ -221,7 +221,7 @@ Content-Type: application/json
 {
     "subject": { "type": "group", "id": "{{engineers_id}}" },
     "resource": { "type": "folder", "id": "{{shared_folder_id}}" },
-    "permissions": ["read"]
+    "role": "viewer"
 }
 
 HTTP 201