[Breaking change] Prepare non-system permission flags (#20847)

# Summary

Replaces the enum-keyed `permissionFlags: PermissionFlag[]` on roles
with `permissionFlagUniversalIdentifiers: string[]`

This unlocks mixing system flags (`SystemPermissionFlag.*`) with
app-defined flags in a role config.

This is a breaking change. Existing app source must switch to the new
field.

# Breaking changes

- `RoleManifest.permissionFlags` removed. Use
`RoleManifest.permissionFlagUniversalIdentifiers: string[]`.
- `RoleConfig.permissionFlags` removed (was `PermissionFlagType[]`). Use
`RoleConfig.permissionFlagUniversalIdentifiers: string[]`.
- `PermissionFlagManifest` type removed from
`twenty-shared/application`.
- `PermissionFlag` re-export removed from `twenty-sdk/define`.
`SystemPermissionFlag` is re-exported in its place.
- Retargeting a permission flag between roles is now classified as
delete + create instead of update

 ### Not in this PR
- definePermissionFlag SDK function and top-level
Manifest.permissionFlags catalog (apps defining their own custom flags).
Until those land, permissionFlagUniversalIdentifiers only accepts
SystemPermissionFlag.* UUIDs; arbitrary UUIDs fail validation.

packages/twenty-shared/src/application/index.ts

@@ -58,7 +58,6 @@ export type { PreInstallLogicFunctionApplicationManifest } from './preInstallLog
 export type {
   ObjectPermissionManifest,
   FieldPermissionManifest,
-  PermissionFlagManifest,
   RoleManifest,
 } from './roleManifestType';
 export type { ServerVariables } from './server-variables.type';

packages/twenty-shared/src/application/roleManifestType.ts

@@ -1,4 +1,3 @@
-import { type PermissionFlagType } from '@/constants';
 import { type SyncableEntityOptions } from '@/application/syncableEntityOptionsType';
 
 export type ObjectPermissionManifest = SyncableEntityOptions & {
@@ -16,10 +15,6 @@ export type FieldPermissionManifest = SyncableEntityOptions & {
   canUpdateFieldValue?: boolean;
 };
 
-export type PermissionFlagManifest = SyncableEntityOptions & {
-  flag: PermissionFlagType;
-};
-
 export type RoleManifest = SyncableEntityOptions & {
   label: string;
   description?: string;
@@ -35,5 +30,5 @@ export type RoleManifest = SyncableEntityOptions & {
   canBeAssignedToApiKeys?: boolean;
   objectPermissions?: ObjectPermissionManifest[];
   fieldPermissions?: FieldPermissionManifest[];
-  permissionFlags?: PermissionFlagManifest[];
+  permissionFlagUniversalIdentifiers?: string[];
 };