Role management: backend CRUD, read models, and UI

[smiggleworth]

Summary

Team management shipped without Role management alongside it -- the backend had DefineRole/AssignRolePermission/AssignTeamRole aggregate handlers but no HTTP/MCP routes, no DeleteRole, no RemoveRolePermission or RemoveTeamRole, and no read model, so "can I manage roles" was still no. This closes that gap, mirroring the Team management slice's pattern throughout:

• New RolePermissionRemoved/TeamRoleRemoved events and DeleteRole/RemoveRolePermission/RemoveTeamRole commands, wired into PermissionProjectionState and PermissionProjector so revoking a permission or unassigning a role from a team actually takes effect in materialized grants (previously only additive assignment was reachable).
• Three new KvDirectory-backed read models: RoleDirectory (list/get roles by name), RolePermissionDirectory (list a role's permissions), and RoleTeamDirectory (list the teams holding a role, materialized role-first from the same TeamRoleAssigned/Removed events rbac-team-roles already emits, so a role's detail page doesn't need a substring-search fallback over an unrelated index).
• RoleCleanupReactor, mirroring TeamCleanupReactor: deleting a role removes its orphaned permission and team assignments instead of leaving them to rot.
• Full HTTP + MCP surface for all of the above, and a /roles, /roles/{roleId} UI (create/delete roles; add/remove permissions and team grants) following the same pages/routing pattern as Teams.

Known limitation carried into this slice (same as Teams): team grants and members are shown by raw ID, not name -- no identity directory exists yet.

Test plan

• dotnet build clean
• dotnet test -- 175/177 passing (the 2 failures are pre-existing, broker-dependent integration tests that need a live Fitz broker, unrelated to this change)
• npm run client:check (typecheck + lint + test + build) clean
• Regenerated the TS API client from a fresh OpenAPI export to pick up the new Role routes
• Manual end-to-end verification against a real local Fitz broker: DefineRole, GetRole, and AssignRolePermission (all point reads/writes) work correctly. ListRoles/ListRolePermissions/ListRoleTeams hit the same already-tracked SCAN wire-protocol bug (Fix SCAN Limit wire-width mismatch with the fitz broker cntryl/fitz-dotnet#33) that blocked ListTeams before that fix -- confirmed via the server log this is the identical pre-existing upstream limitation, not a new regression