Improve initial 'get started' period for organizers

US: As a user I don't want to "go to /c/e endpoints then log out somehow then relog or sg. like that". I want a clear view where I can see my granted roles, refresh my roles and go to the admin page.

AC:

Create a page `apiBaseUrl/lemmein`:
- Show the current roles associated with the user or a login button if there are none
- Create user by logging in
- Check for permissions to add to the user (run this checks not just the first time a user was logged is)
- Add permissions to the page (with permitAll)
- Use colors similar to the admin and use the tenant accent color

Create a new entity `UserGrantEntity`:
- Check by email (both providers) or neptun
- Add the option to grant group, role, permission or permissionGroup
- Groups and roles can: DO_NOT_CHANGE, OVERRIDE
- Permissions and permission groups can: DO_NOT_CHANGE, OVERRIDE, GRANT

Start with the planned apiBaseUrl/lemmein page, the existing admin page, and the login and permission checks described in the issue. Then trace where UserGrantEntity and role, group, permission, and permission-group grants belong. Done means the page supports the listed login, role-refresh, permission, tenant-color, and grant behaviors.

Written by the indexing model from the issue text.