Refactor permission definitions into a shared source of truth #124

Problem

Permissions are currently defined as duplicated string literals across the codebase (backend, WebApp, tests, seed migrations).

This leads to several issues:

• Permission IDs are duplicated in multiple places.
• Typos are not caught at compile time.
• Renaming/refactoring permissions is error-prone.
• Seed migrations require manually maintaining the permission list.

Proposal

Introduce permission manifest files (e.g. JSON) as the single source of truth. Instead of a single file, allow multiple manifest files in a dedicated folder (e.g. one per module/resource), similar to how the OpenAPI specification is used.

A code generator would generate shared Swift types that can be used by the backend, WebApp, tests, and any other target.

Benefits

• Single source of truth.
• Compile-time safety.
• No duplicated permission IDs.
• Better organization by splitting permissions into multiple manifest files.
• Automatic generation of the complete permission list.
• Seed migrations can use the generated complete permission list instead of maintaining it manually.

Screenshots