Move the scenario onto exp_roles and remove the legacy role system

Every call site of expcore.roles now uses exp_roles, and the legacy module,
its config, and the glue which refreshed guis on role events are deleted.
Where a file only renamed the require and the permission strings the change is
mechanical; the rest:

- Jail is now "give the Jail role" and unjail "take it away". The role has a
  higher priority than every other so holding it suppresses them, which is
  what stashing and restoring the roles was for.
- The command role authority derives exp_scenario.command.<name> from the
  command name, and the role parsers use player_outranks rather than comparing
  indexes with their own root check.
- The admin and spectator triggers, and the gui refresh on role changes, live
  in exp_scenario/control/roles.lua; the system commands trigger stays with
  the command authority.
- The player list warn button is keyed on create_warning, the permission
  the command behind it already required, and report on create_report. Both
  were keyed on names no role held, so only root ever saw them.
- The warps and tasks configs say exp_roles where they said expcore.roles.
- The role tables the readme and player list read are replaced by
  get_player_names and get_roles.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

exp_scenario/module/commands/_authorities.lua

@@ -1,26 +1,28 @@
 --[[-- Command Authorities - Roles
-Adds a permission authority for exp roles
+Adds a permission authority which checks the clusterio permission for a command
 ]]
 
 local Commands = require("modules/exp_commands")
 local add, allow, deny = Commands.add_permission_authority, Commands.status.success, Commands.status.unauthorised
 
-local Roles = require("modules/exp_legacy/expcore/roles")
-local player_allowed = Roles.player_allowed
+local Roles = require("modules/exp_roles")
+local player_has_permission = Roles.player_has_permission
 
 local authorities = {}
 
---- If a command has the flag "character_only" then the command can only be used outside of remote view
+--- Every command requires the permission `exp_scenario.command.<name>`, with
+--- hyphens replaced by underscores, see permissions.ts for their definitions
 authorities.exp_permission =
     add(function(player, command)
-        if not player_allowed(player, command.flags.exp_permission or ("command/" .. command.name)) then
+        local permission = "exp_scenario.command." .. command.name:gsub("%-", "_")
+        if not player_has_permission(player, permission) then
             return deny{ "exp-commands-authorities_role.deny" }
         else
             return allow()
         end
     end)
 
-Roles.define_flag_trigger("is_system", function(player, state)
+Roles.define_permission_trigger("exp_scenario.player.system_commands", function(player, state)
     if state then
         Commands.unlock_system_commands(player.name)
     else