Close Role

Take a role off the board without breaking its link.

This is the endpoint the whole three-state design exists for. After it: the role is gone from GET /api/public/roles, gone from the company page's list, and gone from every match -- and GET /api/public/roles/{id} still returns it, with status: "closed" and a closed_at, so every link that was ever shared keeps resolving and every agent that ever cited it can still show what it cited.

Closing a draft is allowed and is a no-op worth having: it is how a company retires something it started writing and does not want in its working list as an unfinished thing. published_at stays null in that case, so the role never appears anywhere public, which is correct -- it never was public.

Idempotent. Closing a closed role keeps the ORIGINAL closed_at: when the opening stopped being available is a fact, and overwriting it on a stray double click would replace it with a lie.