Convert Roles module to MediatR commands/queries

Replaces IRoleService/RoleService. The permission-builder logic moves
to a shared RolePermissionBuilder static helper used by both the
create and update handlers. RolesController keeps its inline
IPermissionService checks unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mws.application/Roles/Queries/GetRoles.cs

@@ -0,0 +1,16 @@
+using AutoMapper;
+using MediatR;
+using Mws.Application.Common;
+
+namespace Mws.Application.Roles;
+
+public record GetRolesQuery : IRequest<List<RoleDto>>;
+
+public class GetRolesHandler(IUnitOfWork uow, IMapper mapper) : IRequestHandler<GetRolesQuery, List<RoleDto>>
+{
+    public async Task<List<RoleDto>> Handle(GetRolesQuery query, CancellationToken ct)
+    {
+        var roles = await uow.Roles.GetAllWithPermissionsAsync(ct);
+        return mapper.Map<List<RoleDto>>(roles);
+    }
+}