fix(auth): reject _own/_all suffixes in permission name validation

Update regex to only allow hyphen-separated multi-word actions
(e.g., assign-roles, force-delete) and reject underscore suffixes
that violate the Permission = Capability architecture decision.