Reference a role preset from the roles it provisions, and re-apply its permissions on demand

### Problem

RoleManager.create_preset_roles() writes a role per active preset when an entity is created, but the role keeps no reference to the preset it came from. Editing a preset therefore changes nothing that already exists, and there is no way to tell a preset-provisioned role from a hand-made one.

### Schema

- roles.role_preset_id: nullable FK to role_presets.id, ON DELETE SET NULL
- Alembic migration, backport-idempotent per models/alembic/README.md
- RoleManager sets it on every role it provisions from a preset
- RoleData / RoleDetailData and the role DTOs carry it

### Sync

Sync re-applies permissions only. The target set is the preset's (entity_type, operation) pairs, written at the scope the role is already attached to: missing rows are inserted, rows outside the set are removed. The role's name, auto_assign, status and scope are untouched.

- Per role: the role's own preset reference; a role with none is refused
- Per preset: every role referencing that preset, in one run

### API surface

- REST v2 + GraphQL mutations for both entry points
- SDK + CLI following the v2 conventions

JIRA Issue: BA-7484

Start with RoleManager.create_preset_roles() and the schema guidance in models/alembic/README.md. Trace the role models and DTOs, then the REST v2, GraphQL, SDK, and CLI entry points named in the issue. Done means preset references persist, both sync entry points update only permission rows at the existing scope, and all listed surfaces expose them.

Written by the indexing model from the issue text.