refactor: migrate user and role management to application layer

[kklldog]

Summary

• add transport-independent user and role management application services
• convert legacy user and role controllers to thin HTTP adapters
• move role permission lookup behind IRoleService and protect system-role state
• add application, controller compatibility, and dependency-boundary tests

Testing

• dotnet test test/AgileConfig.Server.ApplicationTests/AgileConfig.Server.ApplicationTests.csproj --no-restore -m:1 -p:WarningsNotAsErrors=NU1510
• dotnet test test/ApiSiteTests/ApiSiteTests.csproj --no-restore -m:1 -p:WarningsNotAsErrors=NU1510
• dotnet build AgileConfig.sln --no-restore -m:1 -p:WarningsNotAsErrors=NU1510