Convert Roles module to MediatR commands/queries

Replaces IRoleService/RoleService. The permission-builder logic moves
to a shared RolePermissionBuilder static helper used by both the
create and update handlers. RolesController keeps its inline
IPermissionService checks unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mws.application/Roles/RolePermissionBuilder.cs

@@ -0,0 +1,25 @@
+using Mws.Application.Permissions;
+using Mws.Domain.Roles;
+
+namespace Mws.Application.Roles;
+
+internal static class RolePermissionBuilder
+{
+    public static List<RolePermission> Build(List<PermissionEntryDto> entries)
+    {
+        var byScreen = entries.Where(e => ScreenCatalog.Keys.Contains(e.Screen)).ToDictionary(e => e.Screen);
+
+        return ScreenCatalog.Keys.Select(key =>
+        {
+            byScreen.TryGetValue(key, out var entry);
+            return new RolePermission
+            {
+                Screen = key,
+                CanView = entry?.CanView ?? false,
+                CanCreate = entry?.CanCreate ?? false,
+                CanEdit = entry?.CanEdit ?? false,
+                CanDelete = entry?.CanDelete ?? false,
+            };
+        }).ToList();
+    }
+}