Capabilities: declare module defaults once by seeded role id, and check file ownership by capability

Ten modules each hardcode role name lists, `LegacyRoles` and `SeededRoles`: `BarakoCMS.AI/AiCapabilities.cs:24`, `BarakoCMS.Accounting/AccountingCapabilities.cs:34`, `BarakoCMS.Analytics.Umami/AnalyticsCapabilities.cs:33`, `BarakoCMS.Diagnostics/DiagnosticsCapabilities.cs:30`, `BarakoCMS.Email.Resend/ResendEmailCapabilities.cs:24`, `BarakoCMS.FeatureFlags/FeatureFlagCapabilities.cs:24`, `BarakoCMS.Files/FileCapabilities.cs:24`, `BarakoCMS.Import/ImportCapabilities.cs:32`, `BarakoCMS.Portability/PortabilityCapabilities.cs:34`, `BarakoCMS.Pwa/PwaCapabilities.cs:24`. The core does the same in `barakoCMS/Features/Redirects/Endpoints.cs:19`, `Features/Queries/Endpoints.cs:66` and `Features/Connectors/Endpoints.cs:26`, and the module template copies the pattern into every new module. `BarakoCMS.Files/FileOwnership.cs:23` lets a caller through by the names `SuperAdmin` and `Admin`, not by capability.

### Why it is too specific

It works for the roles the core seeds and nothing else. An agency that creates a Site Manager role and grants it the Files capabilities still cannot open other people's files, because `FileOwnership` asks for the name Admin. Every new module copies the same lists again, so changing which seeded role gets a default means editing thirteen files.

### The general concept

A module declares its capability defaults once, keyed by seeded role id, through one core helper. Ownership overrides are capabilities too (for example a manage all files capability), granted to Admin by default.

### Where it lives

Core provides the declaration helper. Each module, plus Redirects, Queries and Connectors in core, uses it, and the module template changes with them.

### Compatibility

Released. `LegacyRoles` is public on the module capability classes, which is package surface, so those statics stay, marked `[Obsolete]` and removed one major away. Seeded roles keep exactly the grants they have today. No HTTP change. Related to #443 and #492, which moved the gates to capabilities but left these lists.

### Done when

- A custom role with the Files ownership capability can read another user's file, and a test showing that fails before the change.
- No module or core feature lists role names for its defaults, and the module template matches.
- Existing seeded roles keep exactly the grants they have now.

Found in the too specific sweep of 15 September 2026.

Start with BarakoCMS.Files/FileOwnership.cs and the capability classes and endpoints listed in the issue, then inspect the module template and existing ownership tests. The change is done when defaults are declared without role-name lists, the template matches, custom roles with the Files ownership capability can read other users' files, and seeded-role grants remain unchanged.

Written by the indexing model from the issue text.