Fetch Roles

Return the effective role catalog per scope.

Scopes are organization, workspace, project. Each entry has role, description, and permissions. Permissions are returned verbatim from access-controls, including the "*" wildcard for owner — callers that need to render the full permission list should expand the wildcard themselves (see ee.src.services.converters._expand_permissions).