feat(application): guard avisos en CreateRubroCommandHandler (CAT-002)

src/api/SIGCM2.Application/Rubros/Create/CreateRubroCommandHandler.cs

@@ -14,17 +14,20 @@ public sealed class CreateRubroCommandHandler : ICommandHandler<CreateRubroComma
     private readonly IAuditLogger _audit;
     private readonly TimeProvider _timeProvider;
     private readonly RubrosOptions _options;
+    private readonly IAvisoQueryRepository _avisoQuery;
 
     public CreateRubroCommandHandler(
         IRubroRepository repo,
         IAuditLogger audit,
         TimeProvider timeProvider,
-        IOptions<RubrosOptions> options)
+        IOptions<RubrosOptions> options,
+        IAvisoQueryRepository avisoQuery)
     {
         _repo = repo;
         _audit = audit;
         _timeProvider = timeProvider;
         _options = options.Value;
+        _avisoQuery = avisoQuery;
     }
 
     public async Task<RubroCreatedDto> Handle(CreateRubroCommand command)
@@ -38,6 +41,12 @@ public sealed class CreateRubroCommandHandler : ICommandHandler<CreateRubroComma
             if (!parent.Activo)
                 throw new RubroPadreInactivoException(command.ParentId.Value);
 
+            // CAT-002: Regla de Oro — padre no puede ser hoja con avisos
+            // CAT-002/PRD-002 TOCTOU — evaluar upgrade a RepeatableRead o constraint DB cuando exista dbo.Aviso
+            var avisosCount = await _avisoQuery.CountAvisosEnRubroAsync(command.ParentId.Value);
+            if (avisosCount > 0)
+                throw new RubroPadreEsHojaConAvisosException(command.ParentId.Value, avisosCount);
+
             // Depth check: parent's depth + 1 must not exceed MaxDepth
             var parentDepth = await _repo.GetDepthAsync(command.ParentId);
             var newDepth = parentDepth + 1;