Module role_delegation_handlers 

HTTP handlers for Story 3.5 — Temporary role delegation (FR8 INV-8).

Routes:

• POST /role-delegations — delegate a role to another user.
• DELETE /role-delegations/{id} — revoke an active delegation.
• GET /role-delegations?subject={u} — list delegations of subject (admin only OR the subject themselves).

Auth: the caller MUST hold the role they want to delegate (checked via their JWT primary role string; the use-case re-checks the native invariant by inspecting persisted assignments).

Structs

DelegateRoleRequest

ListDelegationsQuery

RoleDelegationResponse

create_role_delegation

list_role_delegations

revoke_role_delegation