Add missing foreign key constraints to RBAC tables

Several RBAC tables are missing foreign key constraints, allowing orphan rows when referenced entities are deleted.

Add FK constraints via Alembic migration:

- permissions.role_id → roles.id (CASCADE DELETE)
- user_roles.user_id → users.uuid (CASCADE DELETE)
- user_roles.role_id → roles.id (CASCADE DELETE)

These FKs were lost when migration f41bbe0c0f12 dropped the permission_groups table without re-adding them to the new tables.

JIRA Issue: BA-4736

Review migration f41bbe0c0f12 and the current Alembic migration conventions for the RBAC tables. Verify the permissions and user_roles relationships against roles and users, then confirm that the migration adds all three requested foreign keys with CASCADE DELETE and prevents orphan rows.

Written by the indexing model from the issue text.