[nicdavidson]

Problem

Reported again by a customer ("issue saving RBAC after I have deleted an item, old issue reintroduced"):

1. Open an existing role.
2. Add a service-access row.
3. Delete that row.
4. Click Update.

Nothing happens: there's no request, no message, and the console shows TypeError: access.reduce is not a function.

Cause

Deleting a row only hides it; the row stays in the form array. add() started new rows with access: '', so when onSubmit built the payload over every row, val.access.reduce(...) threw before the request was sent. Rows loaded from the server already have an array there, which is why deleting a saved row worked. The earlier fixes (#370, 8d468ae1) fixed which row gets hidden, not what the payload contains.

Fix

• onSubmit leaves out hidden rows that have no id. They never reached the server, so there's nothing to delete.
• New rows start with access: [].
• The row trash button is type="button". As a plain <button> inside the role <form> it was a submit button.

Tests

e2e/role-save-after-remove.spec.ts, run against a real instance:

• Add a row, remove it, save: the save request goes out, there are no page errors, and the server keeps the original rows. This fails on the current build and passes with the fix.
• Remove a saved row, save: the row is deleted server-side, and removing it doesn't submit the form on its own.

I also ran this merged with #537 (#540 is already merged into it) and current develop. The role specs, the endpoint search/filter flow, npm run test:ci (307/307) and the e2e smoke test all pass.

dist/ is not rebuilt in this PR.