feat(api): UDT-004 dominio + repositorio + application roles (tdd)

- Migraciones V003 (tabla Rol + 8 seeds canonicos) y V004 (drop CK + FK Usuario.Rol)
- Dominio: Rol entity + 3 excepciones (RolNotFound/AlreadyExists/InUse)
- Infraestructura: RolRepository (Dapper) con List/Get/ExistsActive/Add/Update/HasActiveUsuarios
- Application: CRUD queries y commands (List, Get, Create, Update, Deactivate) + validators (codigo regex ^[a-z][a-z0-9_]*$)
- Validator UDT-003: whitelist alineada a codigos canonicos (full IRolRepository lookup diferido a Phase 5.1)
- Tests: 169 application + 15 api (todos verdes). Respawn configurado para re-seedear Rol canonical post-reset.
- Estricto TDD: RED/GREEN/TRIANGULATE en todos los handlers nuevos.

src/api/SIGCM2.Application/Usuarios/Create/CreateUsuarioCommandValidator.cs

@@ -5,7 +5,13 @@ namespace SIGCM2.Application.Usuarios.Create;
 
 public sealed class CreateUsuarioCommandValidator : AbstractValidator<CreateUsuarioCommand>
 {
-    private static readonly string[] ValidRoles = ["admin", "vendedor", "tasador", "consulta"];
+    // Whitelist aligned with canonical seeds in dbo.Rol (migration V003).
+    // Phase 5 of UDT-004 will replace this array with an async lookup against IRolRepository.
+    private static readonly string[] ValidRoles =
+    [
+        "admin", "cajero", "operador_ctacte", "picadora",
+        "jefe_publicidad", "productor", "diagramacion", "reportes"
+    ];
 
     private const int UsernameMinLength = 3;
     private const int UsernameMaxLength = 50;