Address review on the roles plugin

- Use the core role permissions rather than defining new ones. Assignments are
  only sent between the controller and an instance, so they are no longer
  addressed to control and need no permission at all.
- Split the datastore reconciliation into ensureRoleMeta, sweepRoleMeta and
  applyAutoAssign, all run on init as well as when roles change. Properties left
  behind by a role deleted while the plugin was not running are now swept up,
  where before they would be inherited by the next role given that id.
- Use a switch in onControllerConfigFieldChanged, matching instance.ts.
- Resolve pending assignments on initialise. A pending role is either confirmed,
  and so now held by synced_players, or it never landed; either way it stops
  being held locally. Roles assigned with assign_player_local are untouched.
- Drop the emit_updates juggling in reject_assignment, sync is already false.
- Send each permission name once and reference it by index, see the benchmark in
  the pull request. Single role updates stay in the plain form.
- Lay the role properties out in columns, name the apply button for the section
  it belongs to, and give every field a tooltip.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

exp_roles/instance.ts

@@ -49,7 +49,7 @@ export class InstancePlugin extends BaseInstancePlugin {
 		]);
 
 		await this.luaSend("initialise", {
-			roles: roles.map(role => role.toJSON()),
+			...messages.encodeRolesForLua(roles),
 			assignments: assignments.map(assignment => assignment.toJSON()),
 		});
 		await this.luaSetEmitEvents(this.syncMode === "bidirectional");