fix(auth): audit security fixes and add gap-covering tests

- AuthorizationExplainController: validate resource_type via AttributeRegistry
- HasRoles::hasRole(): check only the active role, not all assigned roles
- RoleChartCsvExporter: accept scoped Collection to avoid loading all roles
- PermissionRegistrySynchronizer::prune(): soft-deprecate instead of hard-delete
- PermissionGroup: add is_active column with migration
- Frontend permissions.ts: add 5 missing permission constants
- Tests: inactive-role denial, 3-level inheritance, circular parent prevention,
  self-parenting rejection, document download 403