feat(roles): prepare migration ReBAC to roles

prepare migration of permission to roles
    this simplify drastically database (permission are now simply defined in code)
    and will permit reuse of the same ReBAC engine to define owners of drives

    mapping:

    ```
        Role::Viewer => &[Permission::Read],
        Role::Commenter => &[Permission::Read, Permission::Comment],
        Role::Contributor => &[Permission::Read, Permission::Create],
        Role::Editor => &[
            Permission::Read,
            Permission::Comment,
            Permission::Create,
            Permission::Update,
        ],
        Role::Owner => &[
            Permission::Read,
            Permission::Comment,
            Permission::Create,
            Permission::Update,
            Permission::Share,
            Permission::Delete,
            Permission::Manage,
        ],
    ```

static/js/core/types.js

@@ -367,7 +367,7 @@
  * @property {'user'|'group'|'token'|'external'}   subject_type
  * @property {string}                              subject_id
  * @property {string}                              subject_display - Username (users) or share name (tokens).
- * @property {'viewer'|'editor'|'admin'}           role
+ * @property {'viewer'|'commenter'|'contributor'|'editor'|'owner'} role - Server-emitted role string. `commenter` and `contributor` are reserved for future UI exposure; today the share modal only renders `viewer`/`editor`/`owner` (see `ShareRoleEnum`).
  * @property {string}                              granted_at   - ISO-8601
  * @property {string|null}                         [expires_at] - ISO-8601 or absent.
  * @property {boolean}                             has_password - True when a token subject has a password set.
@@ -453,8 +453,11 @@
 // ------------------- share modal
 
 /**
- * Share roles (DTO-layer sugar for the ReBAC permission sets).
- * @typedef {'viewer'|'editor'|'admin'} ShareRoleEnum
+ * Share-modal-exposed roles. The server's `Role` enum also includes
+ * `commenter` and `contributor` (see `OutgoingResourceGrant.role`); those
+ * are reserved for future UI exposure and are not offered as picker options
+ * today. The "Can manage" UI label maps to `owner`.
+ * @typedef {'viewer'|'editor'|'owner'} ShareRoleEnum
  */
 
 /**