Convert Roles module to MediatR commands/queries

Replaces IRoleService/RoleService. The permission-builder logic moves
to a shared RolePermissionBuilder static helper used by both the
create and update handlers. RolesController keeps its inline
IPermissionService checks unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mws.application/Roles/Queries/GetRole.cs

@@ -0,0 +1,17 @@
+using AutoMapper;
+using MediatR;
+using Mws.Application.Common;
+
+namespace Mws.Application.Roles;
+
+public record GetRoleQuery(Guid Id) : IRequest<RoleDto>;
+
+public class GetRoleHandler(IUnitOfWork uow, IMapper mapper) : IRequestHandler<GetRoleQuery, RoleDto>
+{
+    public async Task<RoleDto> Handle(GetRoleQuery query, CancellationToken ct)
+    {
+        var role = await uow.Roles.GetByIdWithPermissionsAsync(query.Id, ct)
+            ?? throw new NotFoundException("Role not found");
+        return mapper.Map<RoleDto>(role);
+    }
+}