Slight rework of Role feature

  * Add primary role for the primary department — makes it clear what the role for the primary department is
  * Add `permissions` JSON field to the role table for easier access and management of the permissions