refactor(hr): move Custom Roles from Settings into the HR section

Custom roles is staff governance, so it belongs with the team — added a "Roles &
permissions" tab to the HR screen (owner-only) rendering the existing
CustomRolesPanel, and removed the Settings → Team → Custom Roles leaf/group.
fa/en/ar label added.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/dashboard/messages/ar.json

@@ -438,7 +438,8 @@
       "payroll": "الرواتب",
       "access": "صلاحيات الفروع",
       "credentials": "بيانات الدخول",
-      "team": "الموظفون"
+      "team": "الموظفون",
+      "roles": "الأدوار والصلاحيات"
     },
     "myAttendance": "حضوري",
     "clockIn": "تسجيل دخول",

web/dashboard/messages/en.json

@@ -457,7 +457,8 @@
       "payroll": "Payroll",
       "access": "Branch access",
       "credentials": "Login credentials",
-      "team": "Team"
+      "team": "Team",
+      "roles": "Roles & permissions"
     },
     "myAttendance": "My attendance",
     "clockIn": "Clock in",

web/dashboard/messages/fa.json

@@ -457,7 +457,8 @@
       "payroll": "حقوق",
       "access": "دسترسی شعب",
       "credentials": "رمز ورود",
-      "team": "کارکنان"
+      "team": "کارکنان",
+      "roles": "نقش‌ها و دسترسی‌ها"
     },
     "myAttendance": "حضور من",
     "clockIn": "ورود",