The roster behind the "Atribuir" screen — one call, never one per user.

Reusing an existing endpoint was not possible: GET /api/users returns no role or module data and is gated on modulo.utilizadores (this screen is modulo.configuracoes, so an admin holding only Configurações would lose it), GET /company-roles returns holders as a COUNT rather than a roster, and GET /company-roles/users/{id} is the per-user read this exists to replace.

⚠️ Privacy note (deliberate widening, flagged in review): this exposes the staff roster — names and emails — on a modulo.configuracoes route, where today the same list needs modulo.utilizadores. It is admin-gated and tenant-scoped, and an admin can already reach the same names through GET /company-roles holders, but it is a genuine widening of who sees it.