fix(grant): adapt to typed grant-role enum from regenerated client

#2122 made the v1 grant role a validated enum (reader/writer/admin), so the regenerated client types GrantProjectAccess/GrantRepoAccess Role fields as enums rather than string. Validate --role at the CLI boundary and cast to the typed value.