feat(api): UDT-004 dominio + repositorio + application roles (tdd)

- Migraciones V003 (tabla Rol + 8 seeds canonicos) y V004 (drop CK + FK Usuario.Rol)
- Dominio: Rol entity + 3 excepciones (RolNotFound/AlreadyExists/InUse)
- Infraestructura: RolRepository (Dapper) con List/Get/ExistsActive/Add/Update/HasActiveUsuarios
- Application: CRUD queries y commands (List, Get, Create, Update, Deactivate) + validators (codigo regex ^[a-z][a-z0-9_]*$)
- Validator UDT-003: whitelist alineada a codigos canonicos (full IRolRepository lookup diferido a Phase 5.1)
- Tests: 169 application + 15 api (todos verdes). Respawn configurado para re-seedear Rol canonical post-reset.
- Estricto TDD: RED/GREEN/TRIANGULATE en todos los handlers nuevos.

tests/SIGCM2.Application.Tests/Roles/Create/CreateRolCommandHandlerTests.cs

@@ -0,0 +1,86 @@
+using NSubstitute;
+using SIGCM2.Application.Abstractions.Persistence;
+using SIGCM2.Application.Roles.Create;
+using SIGCM2.Domain.Entities;
+using SIGCM2.Domain.Exceptions;
+
+namespace SIGCM2.Application.Tests.Roles.Create;
+
+public class CreateRolCommandHandlerTests
+{
+    private readonly IRolRepository _repository = Substitute.For<IRolRepository>();
+    private readonly CreateRolCommandHandler _handler;
+
+    private static CreateRolCommand ValidCommand() => new("cajero_senior", "Cajero Senior", "Con más permisos");
+
+    public CreateRolCommandHandlerTests()
+    {
+        _handler = new CreateRolCommandHandler(_repository);
+    }
+
+    [Fact]
+    public async Task Handle_CodigoDuplicado_ThrowsRolAlreadyExistsException()
+    {
+        var now = new DateTime(2026, 4, 15, 10, 0, 0, DateTimeKind.Utc);
+        _repository.GetByCodigoAsync("cajero_senior")
+            .Returns(new Rol(99, "cajero_senior", "Cajero Senior", null, true, now, null));
+
+        var ex = await Assert.ThrowsAsync<RolAlreadyExistsException>(
+            () => _handler.Handle(ValidCommand()));
+
+        Assert.Equal("cajero_senior", ex.Codigo);
+    }
+
+    [Fact]
+    public async Task Handle_CodigoDuplicado_DoesNotCallAddAsync()
+    {
+        var now = new DateTime(2026, 4, 15, 10, 0, 0, DateTimeKind.Utc);
+        _repository.GetByCodigoAsync(Arg.Any<string>())
+            .Returns(new Rol(1, "cajero_senior", "X", null, true, now, null));
+
+        try { await _handler.Handle(ValidCommand()); } catch (RolAlreadyExistsException) { }
+
+        await _repository.DidNotReceive().AddAsync(Arg.Any<Rol>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Handle_Happy_AddsAndReturnsDtoWithId()
+    {
+        _repository.GetByCodigoAsync(Arg.Any<string>()).Returns((Rol?)null);
+        _repository.AddAsync(Arg.Any<Rol>(), Arg.Any<CancellationToken>()).Returns(42);
+
+        var result = await _handler.Handle(ValidCommand());
+
+        Assert.Equal(42, result.Id);
+        Assert.Equal("cajero_senior", result.Codigo);
+        Assert.Equal("Cajero Senior", result.Nombre);
+        Assert.Equal("Con más permisos", result.Descripcion);
+        Assert.True(result.Activo);
+    }
+
+    [Fact]
+    public async Task Handle_Happy_CallsAddAsyncOnce()
+    {
+        _repository.GetByCodigoAsync(Arg.Any<string>()).Returns((Rol?)null);
+        _repository.AddAsync(Arg.Any<Rol>(), Arg.Any<CancellationToken>()).Returns(5);
+
+        await _handler.Handle(ValidCommand());
+
+        await _repository.Received(1).AddAsync(
+            Arg.Is<Rol>(r => r.Codigo == "cajero_senior" && r.Nombre == "Cajero Senior" && r.Activo),
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Handle_Happy_WithNullDescripcion_PassesNullToRepository()
+    {
+        _repository.GetByCodigoAsync(Arg.Any<string>()).Returns((Rol?)null);
+        _repository.AddAsync(Arg.Any<Rol>(), Arg.Any<CancellationToken>()).Returns(1);
+
+        await _handler.Handle(new CreateRolCommand("nuevo_rol", "Nuevo", null));
+
+        await _repository.Received(1).AddAsync(
+            Arg.Is<Rol>(r => r.Descripcion == null),
+            Arg.Any<CancellationToken>());
+    }
+}