feat: add role client, PatchRole and DeleteRole endpoints

[The127]

Summary

• Add PatchRoleRequestDto to api/roles.go
• Add PatchRole and DeleteRole HTTP handlers and routes
• Add RoleDelete permission constant and DeleteRole command
• Add role.go client with Create, List, Get, Patch, Delete
• Wire Role(projectSlug) into ProjectClient

Test plan

• PATCH /projects/{slug}/roles/{id} returns 204
• DELETE /projects/{slug}/roles/{id} returns 204
• RoleClient works end-to-end via operator e2e

[The127]

Retriggering CI due to flaky TestKeyStrategy/RS256