Deletes a custom role. Optionally reassigns users with this role to a replacementRoleId.
Requires admin role.

The user migration runs in chunks, so one call may not finish the deletion.

The API Gateway integration for this endpoint is not a proxy and returns HTTP 200 for
everything, including business errors. Do not treat a 200 as "role deleted".
The response body is the only signal of the result:

• status is the discriminator, not the HTTP code.
• status: deleted: the role is deleted.
• status: in_progress: the role is NOT deleted yet. This also comes with HTTP 200.
  There are two shapes of in_progress:
  • Without deletionJobId: the run stopped mid-way (time budget or a failed write).
    Repeat the same call until status is deleted. If you stop early, the role stays half migrated.
  • With deletionJobId: the role had more users than the async threshold, so the deletion was
    handed to a background queue. Do NOT repeat the call: it answers 409 while the job runs.
    The requester is told through the notification center when the job finishes, either way.
• migratedUsers counts only the current run, not the total for the role across runs.
• remainingUsers is how many users still have the role after this run.
• failedUserIds is always present. It is [] when there are no failures.
• A run that migrated users but could not record that progress anywhere does not answer
  in_progress. It comes back with HTTP 200, no status, and
  message: Failed to delete role. — a body without status is a failure, not work in
  progress, and repeating the call will not advance anything until the storage recovers.