RoleUtils is firm domain policy, not a util — move to model/FirmRoleDefaults

utils/RoleUtils (single consumer: FirmServiceImpl firm-creation) encodes the default firm role hierarchy + permissions — domain policy that builds FirmRole/FirmRolePermission model objects, not a generic mechanism. Mislabeled as a util.

Fix: move + rename to model/FirmRoleDefaults (its home alongside the model it constructs; the model imports become redundant there). Move the test to model/FirmRoleDefaultsTest. Coverage-neutral (test moves with the code).

Contrast: utils/DateUtils (a generic, tested US-date formatter) correctly stays in utils/ — it's a reusable mechanism, not one component's domain concern.