feat: better RBAC



## proposal

currently the roles for each user is kinda messed up with no clear boundaries, we should rebuild this from scratch with roles like:
- `platform_admin`: someone who can manage the platform, the git apps, updates, audit logs, etc
- `org_admin`: someone who can manage other users and their powers
- `org_users`: the normal users with powers given my other two

or something like that