feat(permission): extract PermissionDef into shared apps.permission_def

Move PermissionDef out of TENANT_APPS into a new SHARED app so all
tenants read a single global definition table in public schema.

- new app apps.permission_def (label=fonrey_permission_def)
- db_table preserved as permission_defs (no rename)
- FK refs updated: fonrey_permission.PermissionDef -> fonrey_permission_def.PermissionDef
- migrations: permission_def/0001_initial creates table in public,
  permission/0004 drops the now-orphan table from tenant schemas

apps/permission/migrations/0004_alter_rolepermission_permission_def_and_more.py

@@ -0,0 +1,28 @@
+# Generated by Django 4.2.16 on 2026-04-30 04:44
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('fonrey_permission_def', '0001_initial'),
+        ('fonrey_permission', '0003_alter_permissionchangelog_action_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='rolepermission',
+            name='permission_def',
+            field=models.ForeignKey(help_text='RESTRICT 防止删除仍被引用的权限项', on_delete=django.db.models.deletion.PROTECT, related_name='role_assignments', to='fonrey_permission_def.permissiondef', verbose_name='权限定义'),
+        ),
+        migrations.AlterField(
+            model_name='staffpermissionoverride',
+            name='permission_def',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='staff_overrides', to='fonrey_permission_def.permissiondef', verbose_name='被覆盖权限项'),
+        ),
+        migrations.DeleteModel(
+            name='PermissionDef',
+        ),
+    ]