feat(security): add role administration foundation

[sfmskywalker]

Summary

• activate Elsa.Studio.Security in the Studio bundle and Server/WebAssembly hosts
• add internal Refit contracts and DTOs for roles, permission catalog/reach, effective grants, and deletion remediation
• add fail-closed Identity feature and effective-permission context
• gate Security → Roles on identity/roles:view, keep mutation capabilities independent, and remove Users from active navigation
• add direct-route unavailable/forbidden/read-only states and focused contract, service, menu, and bUnit tests

Validation

• dotnet build src/modules/Elsa.Studio.Security/Elsa.Studio.Security.csproj --no-restore --nologo
• dotnet build src/bundles/Elsa.Studio/Elsa.Studio.csproj --no-restore --nologo
• dotnet build src/hosts/Elsa.Studio.Host.Server/Elsa.Studio.Host.Server.csproj --no-restore --nologo
• dotnet build src/hosts/Elsa.Studio.Host.Wasm/Elsa.Studio.Host.Wasm.csproj --no-restore --nologo
• dotnet test src/modules/Elsa.Studio.Security.Tests/Elsa.Studio.Security.Tests.csproj --no-restore --nologo (39 passed)

Closes #971
Closes #972

Stacked on #981.