feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

internal/domain/role/roleRepositoryInterface.go

@@ -4,7 +4,9 @@ type Repository interface {
 	List() ([]Role, error)
 	Get(id uint32) (Role, error)
 	GetByName(name string) (Role, error)
-	ListGrants(roleID uint32) ([]Grant, error)
 	Create(created Role) (Role, error)
 	Save(saved Role) (Role, error)
+	Delete(id uint32) error
+	ReassignMembers(from uint32, to uint32) (int, error)
+	RemoveTypedGrants(typeKey string) (int, error)
 }