feat: define sync capability per namespace

[gmaclennan]

Fixes #318

[achou11]

have a question but i'd consider it non-blocking

[achou11]

looking at this just a few lines above:

const authCoreId = await this.#coreOwnership.getCoreId(deviceId, 'auth')

do you have to wrap that in a try/catch, and return this no role capabilities in the case of the catch? with #317, that call may throw an error if the document isn't found.

Basically, should this block look like this?

      try {
        const authCoreId = await this.#coreOwnership.getCoreId(deviceId, 'auth')
        if (authCoreId === this.#projectCreatorAuthCoreId) {
          return CREATOR_CAPABILITIES
        } else {
          // When no role assignment exists, e.g. a newly added device which has
          // not yet synced role records.
          return NO_ROLE_CAPABILITIES
        }
      } catch (err) {
        // When no role assignment exists, e.g. a newly added device which has
        // not yet synced role records.
        return NO_ROLE_CAPABILITIES
      }