Replace raw @InjectRepository with the workspace-scoped wrapper at every
call site for ObjectPermissionEntity, FieldPermissionEntity,
RowLevelPermissionPredicateEntity, RowLevelPermissionPredicateGroupEntity,
RoleEntity, and RoleTargetEntity in the shared role/object-metadata cache
services so workspaceId is enforced on all reads/writes.
Per-entity follow-up commits cover the remaining single-entity call sites.