refactor(rbac): consolidate role permissions and restructure role editor

[larsgeorge-db]

Summary

Consolidates the duplicate settings-* permissions with their consumption-side counterparts and reshapes the role editor to mirror the actual sidebar layout instead of an arbitrary flat list. Also clarifies the dropdown semantics for "implicit" features (commenting, requesting access grants, viewing process workflows) so None is no longer offered as a choice for features every authenticated user should have access to.

Permission consolidation

Eight settings-* permissions are removed; their consumption-side IDs now gate both the Settings sidebar entry and any cross-app surface. The access level expresses scope (READ_WRITE = use in app, ADMIN = manage the settings page):

Removed	Now gated by
settings-data-domains	data-domains
settings-business-roles	business-roles
settings-delivery-methods	delivery-methods
settings-teams	teams
settings-projects	projects
settings-audit	audit
settings-tags	tags
settings-jobs	jobs

Also removed:

• self-service (only gated POST /data-contracts/{id}/handle-deploy, now uses data-contracts: READ/WRITE since approving a deploy is a modify-contract action).
• llm-search (dead permission — LLM Search routes intentionally bypass PermissionChecker and rely on per-tool result filtering).

Implicit feature levels

Three features that should be available to any authenticated user no longer offer None in the dropdown — new shared IMPLICIT_FEATURE_LEVELS = [READ_ONLY, READ_WRITE, ADMIN]:

• comments (Comments & Ratings)
• access-grants
• process-workflows

Role editor restructuring

role-form-dialog.tsx now mirrors the actual sidebar layout:

• Settings sub-groups (Reference Data → Configuration → Integrations → Operations → Access Control) match the Settings sidebar order exactly. Reference Data sorts Asset Types between Delivery Methods and Teams to match the sidebar.
• Each non-Settings group splits into two sub-sections: sidebar items (sorted by main-nav order) and a new "Background" sub-section (alphabetical) for cross-cutting features without a sidebar entry — comments, access-grants, process-workflows, business-owners, ontology, entity_relationships, schema-importer.
• Hidden features (hidden_from_role_dialog) are skipped entirely (notifications, entity_subscriptions).
• settings-delivery renamed to "Delivery Modes" to disambiguate from the delivery-methods reference data.
• settings-maturity-levels display name fixed (stale "Settings — " prefix removed).

Backend flags surfaced through API

get_features_with_access_levels now passes two flags to the frontend:

• hidden_from_role_dialog: True — backend-only perms with no end-user UI surface.
• cross_cutting: True — features rendered inline (panels, detail pages) without a sidebar entry.

Files changed

• Backend: features.py, settings_manager.py, data_contracts_routes.py, settings_routes.py, tags_routes.py, test_settings_manager.py
• Frontend: role-form-dialog.tsx, settings-layout.tsx, types/settings.ts, settings.json, views (audit-trail, business-roles, data-domains, delivery-methods, projects, teams, settings-jobs, settings-tags)

18 files changed, 431 insertions(+), 184 deletions(-).

Migration note

Existing roles in the DB with comments: None (or other implicit-feature None values) keep that value until the role is next edited — the runtime PermissionChecker is unchanged, only the dropdown options are restricted going forward.

Test plan

• test_settings_manager.py::test_get_features_with_access_levels updated and passing — expected subpage IDs reflect the consolidation; settings-maturity-levels added to the expected set.
• Lints clean on all touched files.
• Backend hot-reloads cleanly with the new feature config.
• Frontend HMR succeeds; role dialog renders the new sub-section structure.
• Manual smoke test: open the role editor and verify
  • Settings sub-groups appear in sidebar order (Reference Data → Configuration → Integrations → Operations → Access Control)
  • Reference Data row order matches the Settings sidebar
  • "Background" sub-sections appear under Build, Govern, and Settings with the right items
  • comments, access-grants, process-workflows dropdowns no longer offer None
  • notifications and entity_subscriptions do not appear at all
• Manual smoke test: edit a non-admin role with reduced tags permission, confirm Tags settings page is gated correctly (R/O hides admin actions, ADMIN shows them) and tag application still works on detail pages at R/W.