feat(permission): extract PermissionDef into shared apps.permission_def

Move PermissionDef out of TENANT_APPS into a new SHARED app so all
tenants read a single global definition table in public schema.

- new app apps.permission_def (label=fonrey_permission_def)
- db_table preserved as permission_defs (no rename)
- FK refs updated: fonrey_permission.PermissionDef -> fonrey_permission_def.PermissionDef
- migrations: permission_def/0001_initial creates table in public,
  permission/0004 drops the now-orphan table from tenant schemas

apps/permission/models/__init__.py

@@ -1,4 +1,3 @@
-from apps.permission.models.permission_def import PermissionDef
 from apps.permission.models.role import Role, RolePermission
 from apps.permission.models.staff_perm import (
     PermissionChangeLog,
@@ -9,7 +8,6 @@ from apps.permission.models.staff_perm import (
 
 __all__ = [
     "PermissionChangeLog",
-    "PermissionDef",
     "Role",
     "RolePermission",
     "StaffDataScope",