Convert Roles module to MediatR commands/queries

Replaces IRoleService/RoleService. The permission-builder logic moves
to a shared RolePermissionBuilder static helper used by both the
create and update handlers. RolesController keeps its inline
IPermissionService checks unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mws.api/Controllers/RolesController.cs

@@ -1,3 +1,4 @@
+using MediatR;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Mws.Application.Permissions;
@@ -8,41 +9,41 @@ namespace Mws.Api.Controllers;
 [ApiController]
 [Route("api/roles")]
 [Authorize]
-public class RolesController(IRoleService roleService, IPermissionService permissions) : ControllerBase
+public class RolesController(ISender sender, IPermissionService permissions) : ControllerBase
 {
     [HttpGet]
     public async Task<ActionResult<List<RoleDto>>> GetAll(CancellationToken ct)
     {
         await permissions.EnsureAsync(User.GetUserId(), "roles", PermissionAction.View, ct);
-        return Ok(await roleService.GetRolesAsync(ct));
+        return Ok(await sender.Send(new GetRolesQuery(), ct));
     }
 
     [HttpGet("{id:guid}")]
     public async Task<ActionResult<RoleDto>> Get(Guid id, CancellationToken ct)
     {
         await permissions.EnsureAsync(User.GetUserId(), "roles", PermissionAction.View, ct);
-        return Ok(await roleService.GetRoleAsync(id, ct));
+        return Ok(await sender.Send(new GetRoleQuery(id), ct));
     }
 
     [HttpPost]
     public async Task<ActionResult<RoleDto>> Create([FromBody] SaveRoleRequest request, CancellationToken ct)
     {
         await permissions.EnsureAsync(User.GetUserId(), "roles", PermissionAction.Create, ct);
-        return Ok(await roleService.CreateRoleAsync(request, ct));
+        return Ok(await sender.Send(new CreateRoleCommand(request), ct));
     }
 
     [HttpPut("{id:guid}")]
     public async Task<ActionResult<RoleDto>> Update(Guid id, [FromBody] SaveRoleRequest request, CancellationToken ct)
     {
         await permissions.EnsureAsync(User.GetUserId(), "roles", PermissionAction.Edit, ct);
-        return Ok(await roleService.UpdateRoleAsync(id, request, ct));
+        return Ok(await sender.Send(new UpdateRoleCommand(id, request), ct));
     }
 
     [HttpDelete("{id:guid}")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         await permissions.EnsureAsync(User.GetUserId(), "roles", PermissionAction.Delete, ct);
-        await roleService.DeleteRoleAsync(id, ct);
+        await sender.Send(new DeleteRoleCommand(id), ct);
         return NoContent();
     }
 }