Sets/updates an AccessPermission for a given (user, role). The caller must be a signed account that is registered in AdminAccounts. The function reads the current permission (failing if the role is not assigned), ensures the new permission differs from the current one, writes the updated permission into AccountRoles storage, emits PermissionUpdated { user, role, permission }, and returns Ok(()).