Move the seed into exp_scenario and seed the permission groups

[bbassie]

Follow up to #453. The seed roles were owned by exp_roles but describe the scenario, so they now live in exp_scenario/seed.ts next to the permissions they grant. Each seed role names the permission group its holders belong to, and the five groups the legacy config defined (Admin, Trusted, Standard, Guest, Restricted) are seeded through exp_groups with one role mapping per role. Mapping priorities follow how exp_roles ranks a player's highest role (priority, then order), so Jail lands in Restricted no matter what else the player holds. System has no group and stays in Factorio's Default group, matching the old set_permission_group("Default", true).

SeedRolesRequest becomes SeedRequest in exp_scenario behind a new exp_scenario.seed permission, and the button moves to the scenario's web plugin (which gains a web entrypoint), still rendered on the roles page. Re-seeding reuses roles by name and only adds permissions, resets groups by name to the seed, reuses the mapping of each seed role, and skips priorities held by other mappings.

With groups seeded from the controller the legacy expcore.permission_groups module, its config, the _file_loader entry and the Group rcon static are removed. exp_roles no longer needs its devDependency on exp_scenario; exp_scenario depends on @expcluster/roles and @expcluster/permission-groups instead.

Tests moved with the seed and grew a controller test that runs the seed against a real Controller with both sibling plugins loaded (pnpm --filter @expcluster/scenario test, 592 assertions; exp_roles still passes with 523). Lua lint is clean.

Smoke tested on my dev cluster against a database that already had the roles and a hand made group mapped at priority 100: the seed created 5 groups and 14 mappings, left the priority 100 mapping alone, re-seeding was idempotent, and the instance showed all five groups in game with the expected allowed action counts (Restricted allows only write_to_console).