docs: the roles page explains the admin option - #232

… is called (#1315)

## What this changes

Closes #1313.

- **An Admin option on every role**, `options.admin`, shown in Settings > Access > Roles as the first toggle of **Access and integrations**. Its users are admins, as the members of the `admin` role, whatever the role is called (`platformAdmins`, `infra_admins`).
- **Applied at sign-in.** A user of such a role gets the `admin` role (`lib/adminRole.js`, `User.getRolesAndOptions`), so every existing admin check (API, jobs, client) holds for them unchanged, with an admin's option defaults.
- **Fixed on two roles.** It is always on for the `admin` role and never on `default`: the role editor shows both greyed out, and the base schema refuses it on the default role.
- **Toggles follow it.** In the editor, turning Admin on or off moves the options an admin gets by default, unless one was set apart.
- **Only admins grant it.** `adminGrants` and `assertAdminRoleUnchanged` count every role that makes admins: only an admin turns the option on for a role with members, or adds members to such a role.
- **Lockout guard.** A save of the roles that would take admin away from the admin saving it is refused with a 409. This covers Settings > Roles, the configuration editor, the designer save and an import of config.yaml.
- **`allowFileUploads`** moves to the Jobs options, last.

## Why

Admin rights hung on the literal role name `admin`, so teams with their own naming conventions could not grant them, and were easily locked out of what only an admin may do (adding credentials of the guarded kinds, for example).

## How it was verified

- New `server/tests/role-admin-switch.test.mjs` covers which roles make admins, the sign-in (the admin role and the admin defaults), the grants, the refusal of a non-admin turning it on, the lockout guard (refused, and allowed when the group moves to a role with Admin on) and the schema refusing it on the default role.
- Client `role-serialization` tests: written for a role with it on, never for `admin` or `default`.
- On a dev server: the toggle on a role and greyed out on `admin`, and a save taking the signed-in admin's group out of every admin role answered 409 with nothing written.

- [x] `cd client && npm run lint:check && npm run format:check && npm run test`
- [x] `cd server && npm run lint:check && npm run test`

BEGIN_COMMIT_OVERRIDE
feat: a role's Admin option makes its users admins, whatever the role is called (#1313)
END_COMMIT_OVERRIDE

Website PR: ansibleforms/website#232

## Checklist

- [x] Branch is named `<type>/<description>` and the title is a Conventional Commit that reads well as a changelog line
- [x] `CHANGELOG.md` is NOT edited - it is generated from the title on release
- [x] UI strings added to **all** locale files (`en`, `de`, `fr`, `it`, `es`, `nl`, `ca`, `pt`, `ja`, `zh`, `pl`)
- [ ] New page has a router entry with a `beforeEnter` guard, and a matching sidebar `permission:` (no new page)
- [ ] New database column is in **both** the schema patch and `create_schema_and_tables.sql`, plus `SCHEMA_MANIFEST` (no new column)
- [ ] A new or changed table or column that holds configuration is covered by the config seed (a role option of config.yaml, not a table)
- [ ] New environment variable has a `server/help.yaml` entry (no environment variable)