feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

test/activity_domain_test.go

@@ -56,7 +56,7 @@ func TestActivityDomain(t *testing.T) {
 		wanted []string
 	}{
 		{"actor.type", activityStrings(audit.ActorTypes()), []string{"anonymous", "api_key", "system", "user"}},
-		{"category", activityStrings(audit.Categories()), []string{"api_keys", "articles", "auth", "authors", "media", "sites", "system", "users"}},
+		{"category", activityStrings(audit.Categories()), []string{"api_keys", "articles", "auth", "authors", "media", "roles", "sites", "system", "users"}},
 		{"outcome", activityStrings(audit.Outcomes()), []string{"failed", "success"}},
 		{"source", activityStrings(audit.Sources()), []string{"api_key", "system", "web"}},
 		{"change.kind", activityStrings(audit.ChangeKinds()), []string{"body", "text"}},