So best to limit the destructive updates in the migration and do them manually

This way they are accessible pretty much everywhere, but are only calculated once. The permission checks themselves are now synchronous and should be really fast, so no need for avoiding checking project ids

Also some QOL fixes for graphql types so that the context is now properly typed

Rather than having these roles separately - incorportate them into
project level roles where it makes sense. That way the same permission
constructs can be used for checking admin roles rather than having to
have separate ones.

even when running locally, it is better to lean on the actual access
controls rather than allowing all access. This way we can catch issues
with permission checks during development

to avoid listing absolutely every project for users with admin roles