List roles in the active scope

Returns the built-in and custom IAM roles visible in the active tenant/subscription/project scope, including each role's permission matrix (resourceKey → manage|read|none), assignable scope levels, member count, and built-in/custom flag. Backs the Roles page route load (role cards plus the per-role permission matrix panel). This single endpoint also serves search/filter/sort/pagination: q matches role id, name and description; builtIn filters built-in vs custom roles; sort/order accept role columns (name, members, updatedAt); page/pageSize paginate. No mutation occurs. Validation: scopeId must reference a tenant/subscription/project scope the caller can access (UNKNOWN_SCOPE → 404 via routing, no access → 403 FORBIDDEN); page/pageSize must be positive integers and order one of asc|desc, otherwise 422 VALIDATION_FAILED. Async & state: Synchronous read; no state change. Errors: 401 when the session is missing or expired; 403 when the caller lacks iam:read in the scope; 422 for malformed pagination/sort parameters; 500 on backend read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. Supports ETag-based revalidation of the collection snapshot.