Permission changes and payment alerts now fail safely

# Permission changes and payment alerts now fail safely

Changing the permissions for a role now confirms that the change was really saved before showing success, recording the change, or notifying connected systems. The permission cache is refreshed only for the affected venue and permission, so the change takes effect without exposing or disturbing another venue's access rules.

Stripe disputes and early fraud warnings are now matched using both the payment's Stripe PaymentIntent and the Stripe account where the payment actually lives. This prevents a payment alert from being attached to the wrong venue when connected accounts are involved.

Several reports and assistant tools that counted bookings by a database field that does not exist now use the booking's real booked-at time. A new automated repository check compares literal database queries with the generated schema and blocks new unknown column references. Existing schema differences are frozen in an explicit inventory and must be reduced deliberately rather than growing unnoticed.

No venue settings, permissions, payments, bookings, or live database records were changed as part of this code update.