[Task] Roles: promote Beta portlet to primary, rename Dojo portlet to Legacy

Description

The Angular rewrite of the Roles portlet is registered as a separate Beta portlet (roles-beta, display name Roles (Beta)) that admins can opt into from the "Add Portlet" picker under Tools. It is not part of any default layout, so end users continue to see the existing Dojo Roles Admin portlet.

Once the Beta portlet has been validated in production and product sign-off is in place, promote the Angular build to the primary roles id and rename the Dojo portlet to roles-legacy so it remains reachable while being clearly labeled as the deprecated implementation.

This swap is intentionally scheduled as a separate ticket so the Beta portlet can bake behind an opt-in install before it becomes the default for every dotCMS user.

Scope note (Aug 2026): the portlet was renamed from "Roles and Tools (Beta)" → "Roles (Beta)". Tools management (Tool Groups / Layouts) is being extracted into its own standalone portlet and tracked separately; the Angular Roles portlet retains only the Users and Permissions tabs for the swap. The Tools iframe wrapper (view_role_tools_wrapper.jsp) stays intact in-repo until the Tools portlet lands so the current Beta continues to function; after the swap it should be dropped from the Roles portlet entirely.

Acceptance Criteria

• dotCMS/src/main/webapp/WEB-INF/portlet.xml: rename the Angular <portlet-name>roles-beta</portlet-name> entry back to roles, display name Roles, portlet-url → /roles. Rename the Dojo entry from roles to roles-legacy, display name Roles Admin Legacy.
• dotCMS/src/main/webapp/WEB-INF/messages/Language.properties: remove the roles-beta title key; add com.dotcms.repackage.javax.portlet.title.roles-legacy=Roles Admin Legacy. The existing roles=Roles key stays and now labels the Angular portlet. Update the ## Roles Portlet (Beta) section header to ## Roles Portlet.
• core-web/apps/dotcms-ui/src/app/app.routes.ts: flip the Angular route path from roles-beta back to roles (matching the promoted portlet-name).
• Any test asserting the portlet count or portletIds is updated (roles-beta → roles-legacy); total count assertion is unchanged. SerializationHelperTest.testFromXmlFile needs its explicit roles-beta pin updated to roles-legacy.
• Drop the Tools tab from the Angular Roles portlet — the dot-role-tools-iframe component, view_role_tools_wrapper.jsp, view_role_tools_inc.jsp, and the tools tab in dot-roles-page.component.html all delete cleanly. The standalone Tools portlet (tracked separately) becomes the sole surface for Tool Groups / Layouts management.
• Data migration (UpgradeTask): existing customer layouts that reference the old Dojo roles portletId should continue to render a working portlet after upgrade — either by promoting them to the Angular portlet at the same id, or by rewriting the layout row to roles-legacy. A documented rollback path is required.
• The Angular portlet is added to the default System / Tools layout so it appears in the menu out of the box for new and upgraded installs. The Legacy portlet remains available in the "Add Portlet" picker but is not in any default layout.
• Product sign-off is recorded in this ticket before the swap PR is merged.

Priority

Medium

Additional Context

Refs the initial Angular implementation task under epic #36909. That ticket delivers the Beta portlet; this ticket delivers the promotion to primary once approval is obtained.

Tools separation is a prerequisite — the standalone Tools portlet must be at least in place (Beta or better) before this swap runs, otherwise promoting the current Beta would carry Tools functionality that we've committed to moving elsewhere.

Start with WEB-INF/portlet.xml, Language.properties, and core-web/apps/dotcms-ui/src/app/app.routes.ts, then inspect the named Roles templates, iframe component, JSPs, and UpgradeTask. Run the portlet ID tests, including SerializationHelperTest.testFromXmlFile. Done means the Angular portlet is primary, the legacy portlet remains reachable, Tools is removed, layouts migrate safely with rollback documented, and default layouts are updated.