feat(bd): V016 create Rubro table con SYSTEM_VERSIONING (CAT-001)

- dbo.Rubro: adjacency list, self-FK, soft-delete, temporal retention 10y
- Filtered unique index UQ_Rubro_ParentId_Nombre_Activo + covering IX_Rubro_ParentId_Activo
- Permission catalogo:rubros:gestionar seeded + assigned to admin role
- V016_ROLLBACK.sql: full reversal script
- RubrosOptions class (MaxDepth=10) + appsettings.json Rubros section
- services.Configure<RubrosOptions> registered in Infrastructure DI
- database/README.md updated with V013-V016 entries

src/api/SIGCM2.Api/appsettings.json

@@ -32,5 +32,8 @@
     ],
     "Enrich": [ "FromLogContext", "WithMachineName", "WithThreadId" ]
   },
+  "Rubros": {
+    "MaxDepth": 10
+  },
   "AllowedHosts": "*"
 }

src/api/SIGCM2.Application/Rubros/RubrosOptions.cs

@@ -0,0 +1,13 @@
+namespace SIGCM2.Application.Rubros;
+
+/// Bound from appsettings section "Rubros".
+/// Controls the maximum allowed depth of the N-ary rubro tree.
+/// Resolvable via IOptions<RubrosOptions> in any handler that enforces the depth rule.
+public sealed class RubrosOptions
+{
+    public const string SectionName = "Rubros";
+
+    /// Maximum tree depth (0 = root level). Default: 10.
+    /// Depth-10 means a root + 9 levels of children.
+    public int MaxDepth { get; set; } = 10;
+}

src/api/SIGCM2.Infrastructure/DependencyInjection.cs

@@ -10,6 +10,7 @@ using SIGCM2.Application.Abstractions.Persistence;
 using SIGCM2.Application.Abstractions.Security;
 using SIGCM2.Application.Audit;
 using SIGCM2.Application.Auth;
+using SIGCM2.Application.Rubros;
 using SIGCM2.Infrastructure.Http;
 using SIGCM2.Infrastructure.Messaging;
 using SIGCM2.Infrastructure.Persistence;
@@ -77,6 +78,9 @@ public static class DependencyInjection
         services.AddHttpContextAccessor();
         services.AddScoped<IClientContext, ClientContext>();
 
+        // CAT-001: Rubros options (MaxDepth) — overridable via appsettings "Rubros".
+        services.Configure<RubrosOptions>(configuration.GetSection(RubrosOptions.SectionName));
+
         // UDT-010: Audit options (SanitizedKeys blacklist) — overridable via appsettings "Audit".
         services.Configure<AuditOptions>(configuration.GetSection(AuditOptions.SectionName));
         services.AddScoped<IAuditContext, SIGCM2.Infrastructure.Audit.AuditContext>();