feat(api): UDT-004 dominio + repositorio + application roles (tdd)

- Migraciones V003 (tabla Rol + 8 seeds canonicos) y V004 (drop CK + FK Usuario.Rol)
- Dominio: Rol entity + 3 excepciones (RolNotFound/AlreadyExists/InUse)
- Infraestructura: RolRepository (Dapper) con List/Get/ExistsActive/Add/Update/HasActiveUsuarios
- Application: CRUD queries y commands (List, Get, Create, Update, Deactivate) + validators (codigo regex ^[a-z][a-z0-9_]*$)
- Validator UDT-003: whitelist alineada a codigos canonicos (full IRolRepository lookup diferido a Phase 5.1)
- Tests: 169 application + 15 api (todos verdes). Respawn configurado para re-seedear Rol canonical post-reset.
- Estricto TDD: RED/GREEN/TRIANGULATE en todos los handlers nuevos.

src/api/SIGCM2.Application/Roles/Create/CreateRolCommandHandler.cs

@@ -0,0 +1,36 @@
+using SIGCM2.Application.Abstractions;
+using SIGCM2.Application.Abstractions.Persistence;
+using SIGCM2.Application.Roles.Dtos;
+using SIGCM2.Domain.Entities;
+using SIGCM2.Domain.Exceptions;
+
+namespace SIGCM2.Application.Roles.Create;
+
+public sealed class CreateRolCommandHandler : ICommandHandler<CreateRolCommand, RolCreatedDto>
+{
+    private readonly IRolRepository _repository;
+
+    public CreateRolCommandHandler(IRolRepository repository)
+    {
+        _repository = repository;
+    }
+
+    public async Task<RolCreatedDto> Handle(CreateRolCommand command)
+    {
+        // Check-then-insert: explicit check produces a clear 409 message.
+        // SqlException 2627 (UQ violation) acts as race-condition fallback — caught in ExceptionFilter.
+        var existing = await _repository.GetByCodigoAsync(command.Codigo);
+        if (existing is not null)
+            throw new RolAlreadyExistsException(command.Codigo);
+
+        var rol = Rol.ForCreation(command.Codigo, command.Nombre, command.Descripcion);
+        var newId = await _repository.AddAsync(rol);
+
+        return new RolCreatedDto(
+            Id: newId,
+            Codigo: rol.Codigo,
+            Nombre: rol.Nombre,
+            Descripcion: rol.Descripcion,
+            Activo: rol.Activo);
+    }
+}