feat(permission): extract PermissionDef into shared apps.permission_def

Move PermissionDef out of TENANT_APPS into a new SHARED app so all
tenants read a single global definition table in public schema.

- new app apps.permission_def (label=fonrey_permission_def)
- db_table preserved as permission_defs (no rename)
- FK refs updated: fonrey_permission.PermissionDef -> fonrey_permission_def.PermissionDef
- migrations: permission_def/0001_initial creates table in public,
  permission/0004 drops the now-orphan table from tenant schemas

config/settings/base.py

@@ -15,6 +15,7 @@ SHARED_APPS = [
     "django_tenants",  # MUST be first per django-tenants
     "apps.tenant",
     "apps.release",
+    "apps.permission_def",
     "shared",
     "django.contrib.contenttypes",
     "django.contrib.auth",