feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

test/role_repository_gaps_test.go

@@ -42,10 +42,10 @@ func TestRoleRepositoryFailures(t *testing.T) {
 		}
 	})
 
-	t.Run("ListGrants and role loading fail when grants cannot be read", func(t *testing.T) {
+	t.Run("List and role loading fail when grants cannot be read", func(t *testing.T) {
 		repo := broken(t, "role_permissions")
-		if _, err := repo.ListGrants(1); err == nil {
-			t.Error("ListGrants: expected error")
+		if _, err := repo.List(); err == nil {
+			t.Error("List: expected error")
 		}
 		if _, err := repo.Get(1); err == nil {
 			t.Error("Get: expected error")