fix: resolve report visibility by role in web context

- ReportPermissionService: query model_has_roles pivot directly
  instead of getRoleNames() which filters by guard and returns
  empty in session (web) context where guard is not 'api'
- ReportPermission: fix role() relationship to point to Spatie
  Role model (id PK) instead of App\Models\Role (role_id PK)
