Work Local and Cloud has independent admin controls

We've added new admin controls for Work and Codex in Enterprise and Edu workspaces. Admins can now manage Work Local and Work Cloud independently, set Fast Mode defaults with custom-role overrides from the Models page, and use a redesigned Roles and Permissions page with clearer navigation.

Existing Work and Fast Mode permissions carry over, browser and network access remain separate, and the RBAC update changes only the admin interface—existing role behavior does not change. These updates make it easier to expand Work and Codex while keeping execution, performance, and permissions aligned with workspace policies.