Make note/submission edit-own and edit-others' permissions explicit

Split note:edit/note:delete and submission:edit/submission:delete into
four independent permissions each - edit_self/delete_self (acting on
your own note or submission) and edit_other/delete_other (acting on
someone else's). Previously "own" access was an unconditional, unrevokable
ownership check with no permission behind it, and a prior round had
accidentally granted coordinator submission:edit/delete by default
(inconsistent with notes, which were correctly own-only) - both are fixed
here: self-service now goes through a real, default-granted-to-everyone
permission, and acting on someone else's note/submission is an explicit
elevated grant that nobody gets by default.

The Role Management permission editor now shows "Edit Own / Delete Own /
Edit Others' / Delete Others'" as four clear, independently toggleable
options instead of one ambiguous "Edit"/"Delete" checkbox.

migrate_role_permissions.py renames the existing permission rows in place
(rather than leaving orphaned duplicates) and includes a one-time,
idempotent correction that revokes the earlier over-grant from coordinator.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/components/role/RoleFormDialog.vue

@@ -148,6 +148,10 @@ const ACTION_LABELS: Record<string, string> = {
   view_internal: 'View Internal',
   view_client: 'View Client',
   change_status: 'Change Status',
+  edit_self: 'Edit Own',
+  delete_self: 'Delete Own',
+  edit_other: "Edit Others'",
+  delete_other: "Delete Others'",
 }
 
 function resourceIcon(resource: string) {

frontend/src/components/task/NoteItem.vue

@@ -157,11 +157,13 @@ const showDeleteDialog = ref(false)
 const isOwnNote = computed(() => authStore.user?.id === props.note.user_id)
 
 const canEdit = computed(() => {
-  return isOwnNote.value || authStore.user?.is_admin || hasPermission('note', 'edit')
+  if (authStore.user?.is_admin) return true
+  return isOwnNote.value ? hasPermission('note', 'edit_self') : hasPermission('note', 'edit_other')
 })
 
 const canDelete = computed(() => {
-  return isOwnNote.value || authStore.user?.is_admin || hasPermission('note', 'delete')
+  if (authStore.user?.is_admin) return true
+  return isOwnNote.value ? hasPermission('note', 'delete_self') : hasPermission('note', 'delete_other')
 })
 
 function getInitials(firstName: string, lastName: string): string {

frontend/src/components/task/SubmissionCard.vue

@@ -150,8 +150,14 @@ const authStore = useAuthStore()
 const { hasPermission } = usePermission()
 
 const isOwnSubmission = computed(() => authStore.user?.id === props.submission.user_id)
-const canEdit = computed(() => isOwnSubmission.value || authStore.user?.is_admin || hasPermission('submission', 'edit'))
-const canDelete = computed(() => isOwnSubmission.value || authStore.user?.is_admin || hasPermission('submission', 'delete'))
+const canEdit = computed(() => {
+  if (authStore.user?.is_admin) return true
+  return isOwnSubmission.value ? hasPermission('submission', 'edit_self') : hasPermission('submission', 'edit_other')
+})
+const canDelete = computed(() => {
+  if (authStore.user?.is_admin) return true
+  return isOwnSubmission.value ? hasPermission('submission', 'delete_self') : hasPermission('submission', 'delete_other')
+})
 
 const editing = ref(false)
 const editNotes = ref('')