[webui] use the package model directly to save roles

Fortunately the models already check for permissions
[webui] calculate the worker status directly in the API