Add user scope model for console authorization

[CerealesMC]

Summary

• Add authorization data model support for console user scoping.
• Introduce role-based behavior (admin vs custom) and resource assignments.
• Enable downstream services to resolve allowed tenants/sites/agents from user relations.

Changes

• Added console_role enum field on User (admin, custom).
• Added user-to-resource permission edges:
  • allowed_tenants
  • allowed_sites
  • allowed_agents
• Added reverse edges on Tenant, Site, and Agent to support efficient scoped queries.

Why

This schema update provides the persistence layer required for least-privilege access in the console while preserving full-access admin behavior.

Validation

• Generate ent code successfully.
• Apply migrations successfully.
• Verify user-role and edge assignments are readable/writable from ent client.