feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

internal/infrastructure/persistence/mappers/roleMapper.go

@@ -1,12 +1,20 @@
 package mappers
 
 import (
+	"time"
+
 	"RenewCMS/internal/domain/role"
 	"RenewCMS/internal/infrastructure/persistence/models"
 )
 
 func RoleToDomain(m models.Role, grants []models.RolePermission) role.Role {
+	var editedAt time.Time
+	if m.EditedAt != nil {
+		editedAt = m.EditedAt.UTC()
+	}
 	return role.Role{
+		UpdatedAt:   editedAt,
+		UpdatedBy:   m.EditedBy,
 		ID:          m.ID,
 		Name:        m.Name,
 		Description: m.Description,
@@ -18,7 +26,14 @@ func RoleToDomain(m models.Role, grants []models.RolePermission) role.Role {
 }
 
 func RoleToModel(r role.Role) models.Role {
+	var editedAt *time.Time
+	if !r.UpdatedAt.IsZero() {
+		stamp := r.UpdatedAt
+		editedAt = &stamp
+	}
 	return models.Role{
+		EditedAt:    editedAt,
+		EditedBy:    r.UpdatedBy,
 		ID:          r.ID,
 		Name:        r.Name,
 		Description: r.Description,