feat(rbac): role eligibility fields, single-parent hierarchy, and role detail modal rework

شرایط احراز: split حداقل سابقه کار into related/unrelated experience
fields, add multi-select رشته تحصیلی (field_of_study option group) and a
توضیحات note, drop language levels; shared ValidatesRequirements concern
DRies store/update validation.

Role hierarchy: a role has exactly one direct manager - replace the
role_inheritances pivot with roles.parent_id (nullOnDelete). API contract
moves parent_ids[] to singular parent_id; cycle guards kept via the
inspector reading roles.parent_id; min-id 'first parent' hacks removed;
RoleResource exposes real parent_id plus the loaded parent relation,
fixing the client inherits-permissions preview.

Role form: permissions and conditional access rules merged into one
tabbed card; collapsible permission-group tree with capped internal
scroll; rule list gains search and a status filter (all / دارای شرط /
نامشروط).

Role chart modal: rebuilt with a NavUser-style header (member identity,
status presence dot, dot-menu actions), tabs for اطلاعات نقش / شرایط
احراز / روابط, member profile cards (personnel code, education, org
tenure from the enriched chart payload), and افزودن کاربر gated to
memberless roles. Adds shared UserAvatar and FormOptionMultiComboboxField
(chips multi-select on Base UI Combobox).

BREAKING CHANGE: role parent assignment is singular (parent_id instead
of parent_ids[]); requirements.min_experience_years replaced by
min_related_experience_years/min_unrelated_experience_years;
requirements.languages removed. Requires migrate:fresh --seed (original
authorization migration corrected).