Four brand roles, and a permissions matrix

Access is set by picking one of four brand role presets rather than assembling permissions by hand, with a matrix showing exactly what each role can do. Workspaces also get a default brand access level, so new team members start with the right reach instead of none.