fix: exclude org-scoped roles from tenant export by filtering type='tenant'

[harshithRai]

🔧 Changes

Excludes organization-scoped roles from the tenant roles export/import flow.

When the api2_org_level_roles_ea feature flag is enabled on a tenant, GET /api/v2/roles starts returning organization-scoped roles (those with type: "organization") mixed in with tenant-level roles. The deploy CLI treats every listed role as tenant configuration, so without this change it would:

• pull org-scoped roles into the tenant baseline (tenant.yaml / roles/*.json)
• report spurious diffs for them on every run
• flag them for deletion when AUTH0_ALLOW_DELETE is enabled, since they are not present in the local config files

The roles handler now passes type: 'tenant' to roles.list so only tenant-level roles are managed. Org-scoped roles are managed within an organization context and are intentionally out of scope here.

The endpoint stays on offset pagination. Although the API spec moves /roles to checkpoint pagination, node-auth0 deliberately kept offset pagination for /roles for backward compatibility (checkpoint is deferred to a future major SDK), so paginate: true is retained rather than switching to checkpoint.

Bumps auth0 to ^6.2.0, which adds the type filter parameter and includes type on the Role response.

Shape change: exported roles now include a type field (returned by the 6.2.0 Role response). This is additive and backward compatible on import. Role IDs are stripped on export as before, so no id is written.

YAML (tenant.yaml):

roles:
  - name: Test Role
    description: Role to reproduce the error
    permissions: []
    type: tenant   # new: present on exported roles

JSON(roles/Test Role.json):

{
  "name": "Test Role",
  "description": "Role to reproduce the error",
  "type": "tenant",
  "permissions": []
}

Migration note

Configs exported while the api2_org_level_roles_ea flag was on may contain organization-scoped roles. After upgrading, these are no longer read from the tenant, so they appear local-only and would be recreated as tenant roles on deploy. Affected roles should be removed from local config after a re-export.

🔬 Testing

Unit tests: test/tools/auth0/handlers/roles.tests.js asserts roles.list is called with type: 'tenant'.

Manual end-to-end against a live tenant with api2_org_level_roles_ea enabled:

1. Created an org-scoped role via the Management API (POST /api/v2/roles with type: "organization" and an owner_id).
2. Confirmed at the API level that GET /api/v2/roles returns it (3 roles) while GET /api/v2/roles?type=tenant does not (2 roles).
3. Ran export in both YAML and directory formats: the org-scoped role was excluded from the output; only tenant roles were written, each with a type field and no id.
4. Ran import --dry-run with the org role present on the tenant: the proposed-changes plan was empty, confirming the org role is not pulled into the baseline and not flagged for deletion (even with AUTH0_ALLOW_DELETE enabled).
5. Deleted the temporary org-scoped role to restore tenant state.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)