refactor(iam): extract CreateRoleInput from create_role

[vieiralucas]

Summary

The parse + validate prologue of `create_role` was 28 lines: RoleName, AssumeRolePolicyDocument, Path, Description, MaxSessionDuration, Tags + tag validation, PermissionsBoundary + ARN format check. Extract `CreateRoleInput::from_query` so `create_role` itself is a 35-line state-mutation flow.

Audited and judged already-clean

• `get_role` (16L): one-shot lookup with one error path. Splitting would not improve readability.
• `list_roles` (68L): clear sequence of validate → filter by path prefix → sort → marker-paginate → render. Each phase is short and focused; pulling the marker-pagination block out would only make sense if more than two list ops shared the exact shape (currently only `list_roles` and `list_access_keys`).

Test plan

• `cargo fmt`
• `cargo clippy -p fakecloud-iam --all-targets -- -D warnings`
• `cargo test -p fakecloud-iam --lib` — 73 passed
• `cargo test --workspace --exclude fakecloud-e2e --exclude fakecloud-conformance`

---

Summary by cubic

Refactored IAM create_role by extracting parsing and validation into CreateRoleInput::from_query, keeping create_role focused on state mutation. No behavior changes.

• Refactors
  • Added CreateRoleInput with from_query to encapsulate:
    • Required params and length checks (RoleName, AssumeRolePolicyDocument).
    • Defaults (Path="/", MaxSessionDuration=3600).
    • Tag parsing and validation.
    • PermissionsBoundary ARN format check.
  • Updated create_role to construct IamRole from CreateRoleInput.
  • Audited get_role and list_roles; left unchanged.

^{Written for commit a345221. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file