Language-based editing permissions

[thorsten]

Part of #3832. New build — no existing infra.

Background

No per-language permission exists today. translate_faq (FAQ_TRANSLATE) applies globally to every language. Editorial teams need "user/group may edit only language L".

Tasks

• Schema: new tables faquser_right_language / faqgroup_right_language (+ DatabaseSchema.php and a new migration in Setup/Migration/Versions/)
• Add hasPermissionForLanguage() to PermissionInterface; implement in BasicPermission and MediumPermission
• Enforce language check in FAQ edit + translate operations and the FAQ query layer
• Combine cleanly with category restrictions (category AND language together)
• Admin UI for per-language assignment
• Define Basic-mode behaviour (Basic mode has no groups)

Acceptance criteria

• Language-specific editing is enforceable per user/group
• A translator scoped to de cannot edit fr content
• Works alongside category restrictions without conflict
• Tests for permission logic + enforcement
• Clear error when blocked by language restriction

[thorsten]

Tracked under epic #4314.