feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

internal/domain/audit/auditDomain.go

@@ -34,6 +34,7 @@ const (
 	CategorySystem   Category = "system"
 	CategorySites    Category = "sites"
 	CategoryAuthors  Category = "authors"
+	CategoryRoles    Category = "roles"
 )
 
 type Outcome string
@@ -80,6 +81,10 @@ const (
 	ActionAuthorCreate         = "author.create"
 	ActionAuthorEdit           = "author.edit"
 	ActionAuthorDelete         = "author.delete"
+	ActionRoleCreate           = "role.create"
+	ActionRoleEdit             = "role.edit"
+	ActionRoleDelete           = "role.delete"
+	ActionRoleReassign         = "role.reassign"
 	ActionMediaUpload          = "media.upload"
 	ActionMediaRename          = "media.rename"
 	ActionMediaDelete          = "media.delete"
@@ -118,6 +123,7 @@ const (
 	TargetRelease = "release"
 	TargetSite    = "site"
 	TargetAuthor  = "author"
+	TargetRole    = "role"
 )
 
 const (
@@ -147,6 +153,10 @@ const (
 	ParamFormat             = "format"
 	ParamQuality            = "quality"
 	ParamTag                = "tag"
+	ParamAdded              = "added"
+	ParamChanged            = "changed"
+	ParamMembers            = "members"
+	ParamMoved              = "moved"
 	FieldTitle              = "title"
 	FieldOnline             = "online"
 	FieldBody               = "body"
@@ -158,6 +168,7 @@ const (
 	FieldFormat             = "format"
 	FieldQuality            = "quality"
 	FieldName               = "name"
+	FieldDescription        = "description"
 	FieldBaseURL            = "base_url"
 	FieldDefaultRobots      = "default_robots"
 	FieldLocale             = "locale"
@@ -193,7 +204,7 @@ func ActorTypes() []ActorType {
 }
 
 func Categories() []Category {
-	return []Category{CategoryArticles, CategoryMedia, CategoryUsers, CategoryAPIKeys, CategoryAuth, CategorySystem, CategorySites, CategoryAuthors}
+	return []Category{CategoryArticles, CategoryMedia, CategoryUsers, CategoryAPIKeys, CategoryAuth, CategorySystem, CategorySites, CategoryAuthors, CategoryRoles}
 }
 
 func Outcomes() []Outcome {