[Task] Roles API: add `DELETE /v1/roles/{roleId}` for role deletion

[hmoreras]

Context

The Angular Roles and Tools portlet (FE task #36930) needs a Delete Role destructive action — surfaced in the Edit Role dialog per the design. The current REST surface has no endpoint for role deletion. The only path today is DWR RoleAjax#deleteRole (dotCMS/src/main/java/com/dotmarketing/business/ajax/RoleAjax.java, ~line 450), which the Angular portlet is dropping.

Add a DELETE /v1/roles/{roleId} endpoint that surfaces the "has dependencies" failure as a structured error the FE can present clearly.

Endpoint Spec

Field	Value
HTTP	DELETE
Path	/v1/roles/{roleId}
Class#method	com.dotcms.rest.api.v1.system.role.RoleResource#deleteRole (new)
Path param	roleId — role ID to delete
Request body	None
Response	ResponseEntityRoleOperationView — { deleted: true, roleId: '...' } on success
Auth gates	requiredBackendUser=true, requiredPortlet("roles"), admin check
OpenAPI	@Operation annotation required; regenerated openapi.yaml committed

Behavior

• Load the role by roleId; 404 if not found
• Reject with 403 if role.isSystem() or role.isLocked()
• Delegate to RoleAPI.delete(role) (or the existing deletion path used by RoleAjax#deleteRole)
• Surface deletion failures as structured errors:
  • Has children → 409 with message message.role.delete.failed.has.children and payload { children: <count> }
  • Has users assigned → 409 with message message.role.delete.failed.has.users and payload { userCount: <count> }
  • Has layouts assigned → 409 with message message.role.delete.failed.has.layouts
  • Generic dependency failure → 409 with message message.role.delete.failed.has.dependencies
• Do NOT force-delete or cascade — dependency cleanup is the caller's responsibility

Acceptance Criteria

• DELETE /v1/roles/{roleId} implemented with the spec above
• @Operation OpenAPI doc added
• swagger-maven-plugin regenerated openapi.yaml committed
• Integration test covering: happy-path delete, delete role with children (→ 409), delete role with users (→ 409), delete role with layouts (→ 409), delete system role (→ 403), delete locked role (→ 403), missing role (→ 404), non-admin caller (→ 403), missing portlet gate (→ 403)
• License + role gating preserved
• Existing DWR deleteRole remains functional
• Each error case returns a distinct error code so the FE can localize the message

References

• Spike audit: [Spike] Roles and Tools: consolidated audit — current state, backend API, target UI mapping #36929 (comment: [Spike] Roles and Tools: consolidated audit — current state, backend API, target UI mapping #36929 (comment))
• Parent epic: Dojo to Angular: Roles and Tools Portlet #36909
• FE consumer blocked by this: [Task] Roles and Tools: Angular implementation + backend wiring #36930
• Current DWR fallback: RoleAjax#deleteRole in dotCMS/src/main/java/com/dotmarketing/business/ajax/RoleAjax.java
• Existing i18n messages: message.role.delete.failed.has.dependencies (present in Language.properties; additional keys may need to be added)

[github-actions]

PRs linked to this issue

• #36939: feat(roles): add DELETE /v1/roles/{roleId} for role deletion by @hassandotcms