Enhance role-check system with stricter checks (#15392)

## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
- ✅ All TypeScript type checks pass
- ✅ ESLint validation passes
- ✅ New permission guards properly enforced
- ✅ Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.

packages/twenty-server/src/engine/metadata-modules/view/utils/view-graphql-api-exception-handler.util.ts

@@ -2,6 +2,7 @@ import { type I18n } from '@lingui/core';
 import { assertUnreachable } from 'twenty-shared/utils';
 
 import {
+  ForbiddenError,
   NotFoundError,
   UserInputError,
 } from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
@@ -45,6 +46,14 @@ export const viewGraphqlApiExceptionHandler = (error: Error, i18n: I18n) => {
         throw new UserInputError(error.message, {
           userFriendlyMessage: error.userFriendlyMessage,
         });
+      case ViewExceptionCode.VIEW_CREATE_PERMISSION_DENIED:
+        throw new ForbiddenError(error.message, {
+          userFriendlyMessage: error.userFriendlyMessage,
+        });
+      case ViewExceptionCode.VIEW_MODIFY_PERMISSION_DENIED:
+        throw new ForbiddenError(error.message, {
+          userFriendlyMessage: error.userFriendlyMessage,
+        });
       default: {
         return assertUnreachable(error.code);
       }
@@ -55,6 +64,8 @@ export const viewGraphqlApiExceptionHandler = (error: Error, i18n: I18n) => {
     switch (error.code) {
       case ViewFieldExceptionCode.VIEW_FIELD_NOT_FOUND:
         throw new NotFoundError(error.message);
+      case ViewFieldExceptionCode.VIEW_NOT_FOUND:
+        throw new NotFoundError(error.message);
       case ViewFieldExceptionCode.INVALID_VIEW_FIELD_DATA:
         throw new UserInputError(error.message, {
           userFriendlyMessage: error.userFriendlyMessage,
@@ -69,6 +80,8 @@ export const viewGraphqlApiExceptionHandler = (error: Error, i18n: I18n) => {
     switch (error.code) {
       case ViewFilterExceptionCode.VIEW_FILTER_NOT_FOUND:
         throw new NotFoundError(error.message);
+      case ViewFilterExceptionCode.VIEW_NOT_FOUND:
+        throw new NotFoundError(error.message);
       case ViewFilterExceptionCode.INVALID_VIEW_FILTER_DATA:
         throw new UserInputError(error.message, {
           userFriendlyMessage: error.userFriendlyMessage,
@@ -83,6 +96,8 @@ export const viewGraphqlApiExceptionHandler = (error: Error, i18n: I18n) => {
     switch (error.code) {
       case ViewFilterGroupExceptionCode.VIEW_FILTER_GROUP_NOT_FOUND:
         throw new NotFoundError(error.message);
+      case ViewFilterGroupExceptionCode.VIEW_NOT_FOUND:
+        throw new NotFoundError(error.message);
       case ViewFilterGroupExceptionCode.INVALID_VIEW_FILTER_GROUP_DATA:
         throw new UserInputError(error.message, {
           userFriendlyMessage: error.userFriendlyMessage,
@@ -97,6 +112,8 @@ export const viewGraphqlApiExceptionHandler = (error: Error, i18n: I18n) => {
     switch (error.code) {
       case ViewGroupExceptionCode.VIEW_GROUP_NOT_FOUND:
         throw new NotFoundError(error.message);
+      case ViewGroupExceptionCode.VIEW_NOT_FOUND:
+        throw new NotFoundError(error.message);
       case ViewGroupExceptionCode.INVALID_VIEW_GROUP_DATA:
         throw new UserInputError(error.message, {
           userFriendlyMessage: error.userFriendlyMessage,
@@ -111,6 +128,8 @@ export const viewGraphqlApiExceptionHandler = (error: Error, i18n: I18n) => {
     switch (error.code) {
       case ViewSortExceptionCode.VIEW_SORT_NOT_FOUND:
         throw new NotFoundError(error.message);
+      case ViewSortExceptionCode.VIEW_NOT_FOUND:
+        throw new NotFoundError(error.message);
       case ViewSortExceptionCode.INVALID_VIEW_SORT_DATA:
         throw new UserInputError(error.message, {
           userFriendlyMessage: error.userFriendlyMessage,