A. For custom roles module (appname_CS) as it is still a core module but put is on a separate app so you can handle all user related things there
B. For Admin role, same just put is on the appname_CS(e.g User_CS)
C. For consumed API you should use (appname_IS) this is where you normalize the consume API to server actions, when using it, you can either expose the server action and consume it on appname_CS or appname_BL. When you expose an API to external consumer, you can use appname_API