Delete a role

Delete a role — only ever a company-authored or a global one.

The full matrix, and why nothing here is a confirmable 409, is in permissions_db.delete_platform_role_guarded. In short: a template deleted from here has no repair path through the product, a system copy comes back under a new id at the next invite, and deleting a HELD role is a company lockout rather than an escalation — get_effective_modules INNER JOINs Z_Roles, so the survivors resolve to the empty set.