feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

test/api_catalogue_drift_test.go

@@ -54,6 +54,7 @@ var routesNotYetInTheCatalogue = []string{
 	"DELETE /v1/content-type/{key}/entry/{id}",
 	"DELETE /v1/image-variants/{name}",
 	"DELETE /v1/media/{id}/variants/{name}",
+	"DELETE /v1/role/{id}",
 	"GET /v1/builtin-type",
 	"GET /v1/builtin-type/{key}",
 	"GET /v1/content-type",
@@ -65,6 +66,8 @@ var routesNotYetInTheCatalogue = []string{
 	"GET /v1/media/{id}/variants",
 	"GET /v1/user/lookup",
 	"GET /v1/permission",
+	"GET /v1/role",
+	"GET /v1/role/{id}",
 	"PATCH /v1/image-variants/{name}",
 	"POST /v1/content-type",
 	"POST /v1/content-type/{key}/entry",
@@ -73,9 +76,13 @@ var routesNotYetInTheCatalogue = []string{
 	"POST /v1/image-variants/{name}/purge",
 	"POST /v1/media/{id}/variants",
 	"POST /v1/media/{id}/variants/{name}",
+	"POST /v1/role",
+	"POST /v1/role/{id}/reassign",
+	"POST /v1/role/{id}/reset",
 	"PUT /v1/content-type/{key}",
 	"PUT /v1/content-type/{key}/entry/{id}",
 	"PUT /v1/image-variants/{name}",
+	"PUT /v1/role/{id}",
 }
 
 func TestRouterRoutesAreInTheCatalogue(t *testing.T) {