Convert Roles module to MediatR commands/queries

Replaces IRoleService/RoleService. The permission-builder logic moves
to a shared RolePermissionBuilder static helper used by both the
create and update handlers. RolesController keeps its inline
IPermissionService checks unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mws.application/Roles/Commands/DeleteRole.cs

@@ -0,0 +1,28 @@
+using MediatR;
+using Mws.Application.Common;
+
+namespace Mws.Application.Roles;
+
+public record DeleteRoleCommand(Guid Id) : IRequest;
+
+public class DeleteRoleHandler(IUnitOfWork uow) : IRequestHandler<DeleteRoleCommand>
+{
+    public async Task Handle(DeleteRoleCommand command, CancellationToken ct)
+    {
+        var role = await uow.Roles.GetByIdAsync(command.Id, ct)
+            ?? throw new NotFoundException("Role not found");
+
+        if (role.IsSystem)
+        {
+            throw new BadRequestException("Cannot delete a system role");
+        }
+
+        if (await uow.Users.ExistsByRoleIdAsync(command.Id, ct))
+        {
+            throw new BadRequestException("Cannot delete a role that is assigned to accounts");
+        }
+
+        uow.Roles.Remove(role);
+        await uow.SaveChangesAsync(ct);
+    }
+}