Implement RBAC REST API handlers

## Overview

Implement all REST API endpoint handlers for the RBAC management system. This includes role CRUD operations and role assignment management, exposing the complete RBAC functionality via HTTP endpoints.

## Scope

### 1. Role CRUD Endpoints

Location: `src/ai/backend/manager/api/rbac/handler.py`

**Class: RBACAPIHandler**

#### POST /roles - Create Role

- Method: `create_role(body: BodyParam[CreateRoleRequest])`
- Permission: Superadmin only
- Returns: HTTP 201 Created with `CreateRoleResponse`

#### POST /roles/search - Search Roles

- Method: `search_roles(body: BodyParam[SearchRolesRequest])`
- Permission: Superadmin only
- Returns: HTTP 200 OK with `SearchRolesResponse`

#### GET /roles/{role_id} - Get Role Details

- Method: `get_role(path: PathParam[GetRolePathParam])`
- Permission: Superadmin only
- Returns: HTTP 200 OK with `GetRoleResponse`

#### PATCH /roles/{role_id} - Update Role

- Method: `update_role(path: PathParam[UpdateRolePathParam], body: BodyParam[UpdateRoleRequest])`
- Permission: Superadmin only
- Returns: HTTP 200 OK with `UpdateRoleResponse`

#### DELETE /roles/{role_id} - Delete Role

- Method: `delete_role(path: PathParam[DeleteRolePathParam])`
- Permission: Superadmin only
- Returns: HTTP 200 OK with `DeleteRoleResponse`

### 2. Role Assignment Endpoints

#### POST /role-assignments - Assign Role

- Method: `assign_role(body: BodyParam[AssignRoleRequest])`
- Permission: Superadmin only
- Returns: HTTP 201 Created with `AssignRoleResponse`

#### DELETE /role-assignments - Revoke Role

- Method: `revoke_role(body: BodyParam[RevokeRoleRequest])`
- Permission: Superadmin only
- Returns: HTTP 200 OK with `RevokeRoleResponse`

#### POST /roles/{role_id}/assigned-users/search - Search Assigned Users

- Method: `search_users_assigned_to_role(path, body)`
- Permission: Superadmin only
- Returns: HTTP 200 OK with `SearchUsersAssignedToRoleResponse`

### 3. Application Factory

Location: `src/ai/backend/manager/api/rbac/__init__.py`

- `create_app(default_cors_options: CORSOptions)`
- Sets up aiohttp application with CORS
- Registers all 8 endpoints with proper HTTP methods
- Configures API version (4, 5) and prefix ("rbac")

## Technical Requirements

### Handler Pattern

```python
@auth_required_for_method
@api_handler
async def method_name(
self,
path: PathParam[...], # if path params needed
body: BodyParam[...], # if request body needed
processors_ctx: ProcessorsCtx,
) -> APIResponse:
# 1. Permission check
# 2. Convert DTO to service input
# 3. Call service action
# 4. Convert result to response DTO
# 5. Return APIResponse
```

### Permission Validation

- Use `current_user()` context
- Check `is_superadmin` flag
- Raise `InsufficientPermission` for unauthorized access

### Service Integration

- Use `ProcessorsCtx` to access processors
- Call appropriate action via `processors.permission_controller.{action_name`}
- Use `wait_for_complete()` for synchronous action execution

### Error Handling

- Let exceptions propagate (handled by middleware)
- Use custom exceptions from BA-3377
- Return appropriate HTTP status codes

## Architecture Flow

```
HTTP Request
↓
Handler Method
↓
Permission Check
↓
DTO → Service Input (via Adapter)
↓
Service Action Call
↓
Service Result → Response DTO (via Adapter)
↓
APIResponse
↓
HTTP Response
```

## Dependencies

### Requires (BA-3377)

- All Request/Response DTOs
- Custom exceptions

### Requires (BA-3378)

- RoleAdapter for data conversion
- AssignedUserAdapter for user queries

### Service Layer (Already Implemented)

- `CreateRoleAction`, `UpdateRoleAction`, etc.
- `PermissionControllerService`

## Acceptance Criteria

- All 8 endpoint handlers implemented
- Permission checks on all endpoints
- Proper HTTP status codes (201 for creates, 200 for others)
- Custom exceptions used for error cases
- Adapters used for DTO conversions
- `create_app` factory function with all routes registered
- CORS configured correctly
- Type checks pass (`pants check`)
- Integration with existing auth middleware

## Integration Notes

### Server Registration

Add to `src/ai/backend/manager/server.py`:

```python
from .api.rbac import create_app as create_rbac_app

# In init_app():
rbac_app, rbac_middlewares = create_rbac_app(cors_options)
root_app.add_subapp("/rbac", rbac_app)
```

### API Prefix

All endpoints are prefixed with `/rbac`:

- Full path example: `POST /rbac/roles`

## Estimated Effort

**Story Points**: 5
**Lines of Code**: ~250 lines

## Related Issues

- GitHub: TBD (new issue number)
- Parent Branch: feat/rearrange-rbac-data-type
- Depends On: BA-3377 (DTOs), BA-3378 (Adapters)
- Completes: RBAC Management API implementation

JIRA Issue: BA-3379