Convert Accounts module to MediatR commands/queries

Replaces IAccountService/AccountService with one command/query per
operation, following the pattern set in the Auth module.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mws.application/Accounts/Commands/UpdateAccount.cs

@@ -0,0 +1,35 @@
+using AutoMapper;
+using MediatR;
+using Mws.Application.Common;
+using Mws.Application.Permissions;
+
+namespace Mws.Application.Accounts;
+
+public record UpdateAccountCommand(Guid ActorUserId, Guid Id, UpdateAccountRequest Request) : IRequest<AccountDto>;
+
+public class UpdateAccountHandler(IUnitOfWork uow, IPermissionService permissions, IMapper mapper)
+    : IRequestHandler<UpdateAccountCommand, AccountDto>
+{
+    private const string Screen = "accounts";
+
+    public async Task<AccountDto> Handle(UpdateAccountCommand command, CancellationToken ct)
+    {
+        await permissions.EnsureAsync(command.ActorUserId, Screen, PermissionAction.Edit, ct);
+
+        var user = await uow.Users.GetByIdWithRoleAsync(command.Id, ct)
+            ?? throw new NotFoundException("Account not found");
+
+        var request = command.Request;
+        var role = await uow.Roles.GetByIdAsync(request.RoleId, ct)
+            ?? throw new BadRequestException("Role not found");
+
+        user.DisplayName = request.DisplayName.Trim();
+        user.RoleId = role.Id;
+        user.Role = role;
+        user.IsActive = request.IsActive;
+        user.UpdatedAt = DateTime.UtcNow;
+
+        await uow.SaveChangesAsync(ct);
+        return mapper.Map<AccountDto>(user);
+    }
+}