Replaces IRoleService/RoleService. The permission-builder logic moves to a shared RolePermissionBuilder static helper used by both the create and update handlers. RolesController keeps its inline IPermissionService checks unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>