fix: handle null defaultRoleId in CommonApiContextBuilderService for application auth

https://sonarly.com/issue/16711?type=bug

Workflow record actions (Find, Create, Update, Delete) fail with "Invalid auth context" for workspaces upgraded from versions before the `defaultRoleId` column was added to `core.application`, because the permission resolver has no fallback for application contexts with a NULL `defaultRoleId`.

Fix: **Changed:** `CommonApiContextBuilderService.getObjectsPermissions()` in `common-api-context-builder.service.ts`

**What:** Separated the `isApplicationAuthContext` check from the `isDefined(defaultRoleId)` check. Previously, these were combined in a single `else if` condition:

```ts
} else if (
  isApplicationAuthContext(authContext) &&
  isDefined(authContext.application.defaultRoleId)
) {
```

When `isApplicationAuthContext` was true but `defaultRoleId` was null, neither this branch nor the `isUserAuthContext` branch matched, causing the code to fall through to the error: `"Invalid auth context - no authentication mechanism found"`.

**Fix:** The application auth context is now always matched first. If `defaultRoleId` is null, the method returns `{}` (empty permissions object = no restrictions). This is consistent with the `shouldBypassPermissionChecks: true` fallback already used in `WorkflowExecutionContextService.buildApplicationExecutionContext()` for the same scenario.

When `defaultRoleId` is present, normal role-based permission resolution continues as before.

**Why this approach:** The root cause is a missing backfill of `defaultRoleId` on the `core.application` table for pre-existing workspaces. While a database migration to backfill would be the deepest fix, the code must also be defensive against this state. Returning unrestricted permissions for applications without a role is the correct behavior — the Twenty Standard Application (the only application that runs workflow actions) should have full access.

packages/twenty-server/src/engine/core-modules/record-crud/services/common-api-context-builder.service.ts

@@ -128,10 +128,11 @@ export class CommonApiContextBuilderService {
         authContext.apiKey.id,
         workspaceId,
       );
-    } else if (
-      isApplicationAuthContext(authContext) &&
-      isDefined(authContext.application.defaultRoleId)
-    ) {
+    } else if (isApplicationAuthContext(authContext)) {
+      if (!isDefined(authContext.application.defaultRoleId)) {
+        return {};
+      }
+
       roleId = authContext.application.defaultRoleId;
     } else if (isUserAuthContext(authContext)) {
       const userWorkspaceRoleId =