RBAC: Manage tenant roles and assignments end to end

## Parent

- #806

## What to build

Deliver tenant role administration as the first persisted scope-owned role tracer. A tenant administrator can list the permission catalog, create and update a flat allow-only role, assign or unassign it to a human subject, inspect assignments, and delete an unassigned custom role. Elsa Studio exposes the complete tenant role and assignment workflow, and a representative workflow action immediately reflects the change.

The underlying role and assignment contracts are reusable by later host and service-principal slices, but this slice proves tenant-wide authority without introducing workflow ACLs, nested roles, explicit denies, role ordering, or direct grants.

Covers PRD user stories 2-3, 12-22, 25, 43-46, 73, 75-76, 78, 95, and 97-98.

## Acceptance criteria

- [ ] A scope-owned role persists immutable ID, tenant scope, scope-unique name, description, explicit permission keys, system/template provenance, concurrency revision, and audit metadata.
- [ ] Role assignments bind a human subject to a role in that role's exact tenant scope; cross-scope assignment and permission combinations are rejected.
- [ ] Tenant role APIs support list, read, create, optimistic update, assigned-role conflict, unassigned custom-role deletion, assignment listing, and idempotent assign/unassign.
- [ ] Roles are flat allow-only bundles; multiple active roles combine by union, missing permission denies, and role references, explicit denies, ordering, and direct resource IDs are rejected.
- [ ] Studio provides catalog-backed tenant role editing, assignment management, conflict recovery, and clear immutable-system-role behavior without checking role names for authorization.
- [ ] A role or assignment change affects a representative workflow request on the next call while the user remains authenticated.
- [ ] Role and assignment mutations emit security audit events without credentials, tokens, secrets, or workflow payloads.
- [ ] Server HTTP, persistence-concurrency, and Studio integration tests prove tenant isolation, CRUD semantics, idempotency, additive grants, default deny, immediate effect, and established problem responses.

## Blocked by

- #829

Read the blocked prerequisite #829 and parent issue #806 first to understand the intended contracts. Then use the server HTTP, persistence-concurrency, and Studio integration test areas named in the acceptance criteria as entry points. Done means the tenant role and assignment workflow satisfies all listed isolation, CRUD, idempotency, authorization, audit, immediate-effect, and integration-test requirements.

Written by the indexing model from the issue text.