Make note/submission edit-own and edit-others' permissions explicit

Split note:edit/note:delete and submission:edit/submission:delete into
four independent permissions each - edit_self/delete_self (acting on
your own note or submission) and edit_other/delete_other (acting on
someone else's). Previously "own" access was an unconditional, unrevokable
ownership check with no permission behind it, and a prior round had
accidentally granted coordinator submission:edit/delete by default
(inconsistent with notes, which were correctly own-only) - both are fixed
here: self-service now goes through a real, default-granted-to-everyone
permission, and acting on someone else's note/submission is an explicit
elevated grant that nobody gets by default.

The Role Management permission editor now shows "Edit Own / Delete Own /
Edit Others' / Delete Others'" as four clear, independently toggleable
options instead of one ambiguous "Edit"/"Delete" checkbox.

migrate_role_permissions.py renames the existing permission rows in place
(rather than leaving orphaned duplicates) and includes a one-time,
idempotent correction that revokes the earlier over-grant from coordinator.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/components/role/RoleFormDialog.vue

@@ -148,6 +148,10 @@ const ACTION_LABELS: Record<string, string> = {
   view_internal: 'View Internal',
   view_client: 'View Client',
   change_status: 'Change Status',
+  edit_self: 'Edit Own',
+  delete_self: 'Delete Own',
+  edit_other: "Edit Others'",
+  delete_other: "Delete Others'",
 }
 
 function resourceIcon(resource: string) {