fix(intent): generate enforced default roles per entity

[NicoleNG18]

Closes #6313

Problem

Apps generated from an app.intent had no enforced access control. Every generated REST controller was effectively open — any authenticated user could read and write every entity — and gen/.../roles/default-roles.roles came out as an empty [].

Root cause was upstream in the intent layer, not the templates: the downstream template-application-rest-java already emits per-operation checkPermissions() enforcement plus the default-roles.roles file, all keyed on the .model entity carrying generateDefaultRoles="true" + roleRead/roleWrite. But EdmIntentGenerator.entityDefaults() hardcoded generateDefaultRoles="false" and never wrote the role names, so the template was fed empty role data.

(Verified: the flag alone is inert — nothing in service-generate/the templates derives the role names from it; the EDM editor's "Generate Default Roles" checkbox works precisely because it also persists roleRead/roleWrite.)

Fix

In EdmIntentGenerator, generate the roles exactly like modeling an entity in the EDM editor with "Generate Default Roles" checked, for every real (controller-backed) entity:

• generateDefaultRoles="true"
• roleRead = <project>.<perspective>.<Entity>ReadOnly
• roleWrite = <project>.<perspective>.<Entity>FullAccess

The perspective segment is the entity's resolved perspective (resolvePerspective): its own name for a top-level entity, its parent's for a composition child, and its own name for a setting too — never the shared Settings shell grouping — consistent with how regular intent entities name their roles. PROJECTION entities stay unsecured (read-only). The generated .edm XML carries the three attributes as well, so a generated .edm opens in the EDM editor with the box checked.

No template change is required — the rest-java controller template and the AngularJS/Harmonia perspective templates already consume this metadata.

Behavior change

Generated apps are now secure by default (parity with the EDM checkbox): an administrator assigns the generated <Entity>ReadOnly/FullAccess roles to users. Super-role / anonymous-mode handling is unchanged.

Tests

• EdmIntentGeneratorTest (18/0/0): a regular entity (library.Book.BookReadOnly) and a setting entity (library.Genre.GenreReadOnly, perspectiveName="Settings") both carry the roles; a PROJECTION entity stays generateDefaultRoles="false" with no roleRead.
• IntentEngineIT (32/0/0): the generated .edm/.model carry generateDefaultRoles="true" + the role names, and the setting entity Country uses its own perspective (.Country.CountryReadOnly), not the Settings shell perspective.

Formatter and release-profile javadoc both pass on the touched module.

🤖 Generated with Claude Code