fix(rbac): register user:manage and vm:manage, close legacy map gaps

These permissions were referenced by the API (users.manage, proxmox.vm.manage)
but never registered in the permission registry, so they only worked through
the is_admin bypass — non-admin users granted them silently received 403.

- Register user:manage and vm:manage in the registry.
- Add missing legacy mappings: users.manage->user:manage,
  settings.manage->setting:manage.
- Grant both new permissions to the admin role (defaults + init.sql seed);
  ensure_default_roles_new_format propagates them to existing deployments.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/rbac/migration.py

@@ -37,6 +37,7 @@ NEW_DEFAULT_ROLES = [
             "vm:console": True,
             "vm:migrate": True,
             "vm:execute": True,
+            "vm:manage": True,
             # LXC
             "lxc:view": True,
             "lxc:create": True,
@@ -69,6 +70,7 @@ NEW_DEFAULT_ROLES = [
             "user:create": True,
             "user:update": True,
             "user:delete": True,
+            "user:manage": True,
             # Roles
             "role:view": True,
             "role:create": True,