refactor: fix 7 CRUD system inconsistencies for robustness and maintainability

- Add user-assignment dependency check to DepartmentService.deleteByUuid (409 when users assigned)
- Standardize POST detection to isMethod('POST') in 10 create/edit actions
- Align RoleService code uniqueness to warning pattern (matching departments)
- Normalize repository create() return types from mixed to int|false (3 repos + 3 interfaces)
- Add JSON response branches to 4 non-user delete actions
- Document delete authorization ordering pattern
- Decompose AdminSettingsService.updateFromAdmin into domain-scoped private methods

Workflow: .agents/runs/CRUD-CONSISTENCY-001/
Reviewed by: Code Reviewer (pass), Security Reviewer (pass), Acceptance Tester (pass)
Quality gates: QG-001 PHPUnit pass, QG-002 PHPStan pass, QG-003 Architecture pass

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pages/admin/permissions/create().php

@@ -39,7 +39,7 @@ if ($request->isMethod('POST') && !Session::checkCsrfToken()) {
     return;
 }
 
-if ($request->hasBody('key')) {
+if ($request->isMethod('POST')) {
     $result = app(\MintyPHP\Service\Access\PermissionService::class)->createFromAdmin($request->bodyAll());
     $form = $result['form'] ?? $form;
     $errorBag->merge($result['errors'] ?? []);

pages/admin/permissions/delete($id).php

@@ -1,5 +1,6 @@
 <?php
 
+use MintyPHP\Http\Request;
 use MintyPHP\Http\SessionStoreInterface;
 use MintyPHP\Router;
 use MintyPHP\Service\Access\PermissionAuthorizationPolicy;
@@ -12,10 +13,18 @@ Guard::requireLogin();
 
 $currentUserId = (int) ($session['user']['id'] ?? 0);
 $authorizationService = app(\MintyPHP\Service\Access\AuthorizationService::class);
+// Authorization is checked generically (can user delete ANY permission?) before loading the entity.
+// Context-aware policies (departments, tenants, users) load the entity first to pass target_id.
+// Both patterns are valid; context-aware is preferred for new code.
 $decision = $authorizationService->authorize(PermissionAuthorizationPolicy::ABILITY_ADMIN_PERMISSIONS_DELETE, [
     'actor_user_id' => $currentUserId,
 ]);
 if (!$decision->isAllowed()) {
+    if (Request::wantsJson()) {
+        http_response_code($decision->status());
+        Router::json(['error' => $decision->error()]);
+        return;
+    }
     Guard::deny();
 }
 
@@ -30,18 +39,31 @@ $affectedUserIds = app(\MintyPHP\Repository\Access\UserRoleRepository::class)->l
 
 $result = app(PermissionService::class)->deleteById($id);
 if (!($result['ok'] ?? false)) {
-    $error = (string) ($result['error'] ?? '');
+    $error = (string) ($result['error'] ?? 'not_found');
+    $status = $result['status'] ?? 500;
+    if (Request::wantsJson()) {
+        http_response_code($status);
+        Router::json(['error' => $error]);
+        return;
+    }
     if ($error === 'system_permission_protected') {
         Flash::error('System permission can not be deleted', 'admin/permissions', 'permission_system_protected');
     } else {
         Flash::error('Permission not found', 'admin/permissions', 'permission_not_found');
     }
     Router::redirect('admin/permissions');
+    return;
 }
 
 if ($affectedUserIds) {
     app(\MintyPHP\Repository\User\UserWriteRepository::class)->bumpAuthzVersionByUserIds($affectedUserIds);
 }
 
+if (Request::wantsJson()) {
+    http_response_code(204);
+    Router::json([]);
+    return;
+}
+
 Flash::success('Permission deleted', 'admin/permissions', 'permission_deleted');
 Router::redirect('admin/permissions');

pages/admin/permissions/edit($id).php

@@ -54,7 +54,7 @@ if ($request->isMethod('POST') && !Session::checkCsrfToken()) {
     return;
 }
 
-if ($request->hasBody('key')) {
+if ($request->isMethod('POST')) {
     $submitDecision = $authorizationService->authorize(PermissionAuthorizationPolicy::ABILITY_ADMIN_PERMISSIONS_EDIT_SUBMIT, [
         'actor_user_id' => $currentUserId,
         'target_permission_id' => $id,