Legacy role checks perform broad scans instead of direct role lookups

[david-rocca]

Evidence:

• src/utils/utils.js:59-81 gets an org UUID, queries all Secretariat orgs, and loops to compare UUIDs.
• src/utils/utils.js:84-98 queries all Secretariat orgs by UUID.
• src/utils/utils.js:100-115 queries all Bulk Download orgs and loops.

Impact:

• Role checks do extra database work and are harder to reason about than direct predicates.
• Similar logic exists elsewhere through repository methods such as hasRoleByUUID.