Convert Roles module to MediatR commands/queries

Replaces IRoleService/RoleService. The permission-builder logic moves
to a shared RolePermissionBuilder static helper used by both the
create and update handlers. RolesController keeps its inline
IPermissionService checks unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mws.application/Roles/Commands/UpdateRole.cs

@@ -0,0 +1,40 @@
+using AutoMapper;
+using MediatR;
+using Mws.Application.Common;
+
+namespace Mws.Application.Roles;
+
+public record UpdateRoleCommand(Guid Id, SaveRoleRequest Request) : IRequest<RoleDto>;
+
+public class UpdateRoleHandler(IUnitOfWork uow, IMapper mapper) : IRequestHandler<UpdateRoleCommand, RoleDto>
+{
+    public async Task<RoleDto> Handle(UpdateRoleCommand command, CancellationToken ct)
+    {
+        var role = await uow.Roles.GetByIdWithPermissionsAsync(command.Id, ct)
+            ?? throw new NotFoundException("Role not found");
+
+        var name = command.Request.Name.Trim();
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            throw new BadRequestException("Role name is required");
+        }
+
+        if (await uow.Roles.ExistsByNameAsync(name, command.Id, ct))
+        {
+            throw new BadRequestException("Role name already exists");
+        }
+
+        role.Name = name;
+        role.UpdatedAt = DateTime.UtcNow;
+
+        uow.Roles.RemovePermissions(role.Permissions.ToList());
+        role.Permissions = RolePermissionBuilder.Build(command.Request.Permissions);
+        foreach (var p in role.Permissions)
+        {
+            p.RoleId = role.Id;
+        }
+
+        await uow.SaveChangesAsync(ct);
+        return mapper.Map<RoleDto>(role);
+    }
+}