feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

internal/infrastructure/useCases/ListRoles.go

@@ -0,0 +1,24 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/contenttype"
+	"RenewCMS/internal/domain/role"
+	"RenewCMS/internal/domain/user"
+)
+
+type ListRolesUseCase struct {
+	roles  role.Repository
+	viewer roleViewer
+}
+
+func NewListRolesUseCase(roles role.Repository, users user.Repository, contentTypes contenttype.Repository) *ListRolesUseCase {
+	return &ListRolesUseCase{roles: roles, viewer: roleViewer{roles, users, contentTypes}}
+}
+
+func (u *ListRolesUseCase) List() ([]RoleView, error) {
+	found, err := u.roles.List()
+	if err != nil {
+		return nil, err
+	}
+	return u.viewer.views(found)
+}