feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

internal/infrastructure/useCases/GetRole.go

@@ -0,0 +1,28 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/contenttype"
+	"RenewCMS/internal/domain/role"
+	"RenewCMS/internal/domain/user"
+)
+
+type GetRoleUseCase struct {
+	roles  role.Repository
+	viewer roleViewer
+}
+
+func NewGetRoleUseCase(roles role.Repository, users user.Repository, contentTypes contenttype.Repository) *GetRoleUseCase {
+	return &GetRoleUseCase{roles: roles, viewer: roleViewer{roles, users, contentTypes}}
+}
+
+func (u *GetRoleUseCase) Get(id uint32) (RoleView, error) {
+	found, err := u.roles.Get(id)
+	if err != nil {
+		return RoleView{}, err
+	}
+	members, err := u.viewer.members(found.ID)
+	if err != nil {
+		return RoleView{}, err
+	}
+	return u.viewer.one(found, members)
+}