feat: better RBAC

[07CalC]

proposal

currently the roles for each user is kinda messed up with no clear boundaries, we should rebuild this from scratch with roles like:

• platform_admin: someone who can manage the platform, the git apps, updates, audit logs, etc
• org_admin: someone who can manage other users and their powers
• org_users: the normal users with powers given my other two

or something like that