feat(privileges): add privileges

and update user/role models