Roles and per-app permissions

Role-based access control in the dashboard.

• A /roles page to define roles, listed in the sidebar.
• Creating a user assigns roles and per-app permissions in the same dialog, through a grants editor that picks apps, roles and individual permissions.
• App-scoped pages (Updates, Channels, App info, Tokens) show an empty state with a create button for admins when the server has no app yet.