Create a role for a company

Create a company-owned role.

The company is REQUIRED and comes from the body — never from the session, which on a system_admin route is whichever tenant the admin last switched into (docs/claude/02-security.md §10).

Validated against get_company_universe(), NOT Empresas: two active users carry IDempresa = 2 with no Empresas row, and that company owns six live role copies. Refusing it would refuse a real tenant.

Deliberately cannot create a TEMPLATE. A template minted from a dialog has an empty Z_RolePermissions: fanned out it gives every company a role that grants nothing, not fanned out it gives a template nobody can hold (both assignment paths reject templates). The six real templates are versioned artefacts of two SQL scripts that would not know about a seventh. template_key is not accepted either — stamping one on a hand-made role disguises it as a system copy, which locks the tenant out of editing it (_assert_role_is_company_authored) and stops ensure_company_role_copies from ever re-creating it.