refactor: restructure domain crate by bounded context

crates/domain/src/identity/services.rs

@@ -0,0 +1,21 @@
+use std::collections::HashSet;
+use super::entities::{Permission, PermissionAction, ResourceType, Role};
+
+pub struct PermissionChecker;
+
+impl PermissionChecker {
+    pub fn has_permission(
+        roles: &[Role],
+        action: PermissionAction,
+        resource_type: ResourceType,
+    ) -> bool {
+        roles.iter().any(|role| {
+            role.has_permission(action, resource_type)
+                || role.has_permission(action, ResourceType::Global)
+        })
+    }
+
+    pub fn effective_permissions(roles: &[Role]) -> HashSet<Permission> {
+        roles.iter().flat_map(|r| r.permissions.iter().copied()).collect()
+    }
+}