feat(api): add authorization:grant-all command with optional role assignment