feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

internal/infrastructure/useCases/GetMyAccess.go

@@ -46,15 +46,5 @@ func (u *GetMyAccessUseCase) Get(account user.User) (Access, error) {
 	if err != nil {
 		return Access{}, err
 	}
-	return Access{Role: resolved, Permissions: effectiveGrants(resolved.GrantSet())}, nil
-}
-
-func effectiveGrants(grants role.GrantSet) []role.Grant {
-	effective := []role.Grant{}
-	for _, permission := range role.Catalogue() {
-		if scope := grants.ScopeFor(permission.Key, ""); scope != role.ScopeNone {
-			effective = append(effective, role.Grant{Key: permission.Key, Scope: scope})
-		}
-	}
-	return effective
+	return Access{Role: resolved, Permissions: resolved.EffectiveGrants()}, nil
 }