feat(api): UDT-004 dominio + repositorio + application roles (tdd)

- Migraciones V003 (tabla Rol + 8 seeds canonicos) y V004 (drop CK + FK Usuario.Rol)
- Dominio: Rol entity + 3 excepciones (RolNotFound/AlreadyExists/InUse)
- Infraestructura: RolRepository (Dapper) con List/Get/ExistsActive/Add/Update/HasActiveUsuarios
- Application: CRUD queries y commands (List, Get, Create, Update, Deactivate) + validators (codigo regex ^[a-z][a-z0-9_]*$)
- Validator UDT-003: whitelist alineada a codigos canonicos (full IRolRepository lookup diferido a Phase 5.1)
- Tests: 169 application + 15 api (todos verdes). Respawn configurado para re-seedear Rol canonical post-reset.
- Estricto TDD: RED/GREEN/TRIANGULATE en todos los handlers nuevos.

database/migrations/V004__alter_usuario_rol_fk.sql

@@ -0,0 +1,44 @@
+-- V004__alter_usuario_rol_fk.sql
+-- Replaces the hardcoded CHECK constraint on Usuario.Rol with a FOREIGN KEY
+-- against dbo.Rol(Codigo). Must run AFTER V003 (which creates dbo.Rol and seeds the
+-- codes already in use, including 'admin').
+-- Run on: SIGCM2 (prod) and SIGCM2_Test (integration tests)
+
+SET QUOTED_IDENTIFIER ON;
+SET ANSI_NULLS ON;
+SET NOCOUNT ON;
+GO
+
+-- 1) Drop the old hardcoded whitelist CHECK constraint (if still present).
+IF EXISTS (
+    SELECT 1 FROM sys.check_constraints
+    WHERE name = 'CK_Usuario_Rol'
+      AND parent_object_id = OBJECT_ID(N'dbo.Usuario')
+)
+BEGIN
+    ALTER TABLE dbo.Usuario DROP CONSTRAINT CK_Usuario_Rol;
+    PRINT 'Dropped CK_Usuario_Rol (hardcoded whitelist).';
+END
+ELSE
+BEGIN
+    PRINT 'CK_Usuario_Rol not present — skipping drop.';
+END
+GO
+
+-- 2) Add the FK Usuario.Rol -> Rol.Codigo (only if not already present).
+IF NOT EXISTS (
+    SELECT 1 FROM sys.foreign_keys
+    WHERE name = 'FK_Usuario_Rol'
+      AND parent_object_id = OBJECT_ID(N'dbo.Usuario')
+)
+BEGIN
+    ALTER TABLE dbo.Usuario
+        ADD CONSTRAINT FK_Usuario_Rol
+            FOREIGN KEY (Rol) REFERENCES dbo.Rol(Codigo);
+    PRINT 'Added FK_Usuario_Rol -> dbo.Rol(Codigo).';
+END
+ELSE
+BEGIN
+    PRINT 'FK_Usuario_Rol already present — skipping.';
+END
+GO