Label scoped RBAC policies are rejected by the role dialog, so roles that use them cannot be edited

POLICIES_STRING_REGEX in web/src/constants/project.ts does not allow the
{key:value} label block that a resource can carry, so the Add Role and Edit
Role dialogs reject any policy that scopes a resource by labels:

resources=application{env:prod};actions=get        -> "Invalid policy format"
resources=application{env:prod,team:foo};actions=get -> "Invalid policy format"
resources=application{env:prod},piped;actions=get  -> "Invalid policy format"

The rest of the stack supports labels:

• ProjectRBACResource has a labels map in pkg/model/project.proto
• parseRBACPolicies parses the {...} block (RESOURCES_LABELS_REGEX)
• formalizePoliciesList writes the {...} block back out

The worst part is editing. EditRoleDialog fills the textarea with
formalizePoliciesList(...), which emits the label block, and validates it
with POLICIES_STRING_REGEX. So opening a role that uses labels shows a form
that is already invalid according to its own validation, and the role cannot
be saved even if nothing is changed.

The dialogs accept the same policy syntax that parseRBACPolicies and
formalizePoliciesList already handle, so label scoped roles can be created
and edited.

How to reproduce it:

Round tripping through the two helpers works fine:

"resources=application{env:prod};actions=get"
  -> parseRBACPolicies -> formalizePoliciesList
  -> "resources=application{env:prod};actions=get"

but the same string fails the form's validation schema:

yup.string().matches(POLICIES_STRING_REGEX).isValidSync(
  "resources=application{env:prod};actions=get"
) // false

In the UI: Settings > Project > Roles > Add Role, enter
resources=application{env:prod};actions=get, and the field shows
"Invalid policy format" so the submit button stays disabled.

Start in web/src/constants/project.ts with POLICIES_STRING_REGEX, then compare it with RESOURCES_LABELS_REGEX and the label handling in parseRBACPolicies and formalizePoliciesList. Verify that the Add Role and Edit Role dialogs accept label-scoped examples such as resources=application{env:prod};actions=get and can save an unchanged role.