feat(api): UDT-004 dominio + repositorio + application roles (tdd)

- Migraciones V003 (tabla Rol + 8 seeds canonicos) y V004 (drop CK + FK Usuario.Rol)
- Dominio: Rol entity + 3 excepciones (RolNotFound/AlreadyExists/InUse)
- Infraestructura: RolRepository (Dapper) con List/Get/ExistsActive/Add/Update/HasActiveUsuarios
- Application: CRUD queries y commands (List, Get, Create, Update, Deactivate) + validators (codigo regex ^[a-z][a-z0-9_]*$)
- Validator UDT-003: whitelist alineada a codigos canonicos (full IRolRepository lookup diferido a Phase 5.1)
- Tests: 169 application + 15 api (todos verdes). Respawn configurado para re-seedear Rol canonical post-reset.
- Estricto TDD: RED/GREEN/TRIANGULATE en todos los handlers nuevos.

tests/SIGCM2.Application.Tests/Roles/Deactivate/DeactivateRolCommandHandlerTests.cs

@@ -0,0 +1,98 @@
+using NSubstitute;
+using SIGCM2.Application.Abstractions.Persistence;
+using SIGCM2.Application.Roles.Deactivate;
+using SIGCM2.Domain.Entities;
+using SIGCM2.Domain.Exceptions;
+
+namespace SIGCM2.Application.Tests.Roles.Deactivate;
+
+public class DeactivateRolCommandHandlerTests
+{
+    private readonly IRolRepository _repository = Substitute.For<IRolRepository>();
+    private readonly DeactivateRolCommandHandler _handler;
+
+    private static Rol RolActive(string codigo, int id = 10)
+    {
+        var now = new DateTime(2026, 4, 15, 10, 0, 0, DateTimeKind.Utc);
+        return new Rol(id, codigo, "Nombre", "Desc", true, now, null);
+    }
+
+    public DeactivateRolCommandHandlerTests()
+    {
+        _handler = new DeactivateRolCommandHandler(_repository);
+    }
+
+    [Fact]
+    public async Task Handle_NonExistentCodigo_ThrowsRolNotFoundException()
+    {
+        _repository.GetByCodigoAsync("missing").Returns((Rol?)null);
+
+        var ex = await Assert.ThrowsAsync<RolNotFoundException>(
+            () => _handler.Handle(new DeactivateRolCommand("missing")));
+
+        Assert.Equal("missing", ex.Codigo);
+    }
+
+    [Fact]
+    public async Task Handle_CodigoConUsuariosActivos_ThrowsRolInUseException()
+    {
+        _repository.GetByCodigoAsync("cajero").Returns(RolActive("cajero"));
+        _repository.HasActiveUsuariosAsync("cajero").Returns(true);
+
+        var ex = await Assert.ThrowsAsync<RolInUseException>(
+            () => _handler.Handle(new DeactivateRolCommand("cajero")));
+
+        Assert.Equal("cajero", ex.Codigo);
+    }
+
+    [Fact]
+    public async Task Handle_RolInUse_DoesNotCallUpdateAsync()
+    {
+        _repository.GetByCodigoAsync("cajero").Returns(RolActive("cajero"));
+        _repository.HasActiveUsuariosAsync("cajero").Returns(true);
+
+        try { await _handler.Handle(new DeactivateRolCommand("cajero")); } catch (RolInUseException) { }
+
+        await _repository.DidNotReceive().UpdateAsync(
+            Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string?>(), Arg.Any<bool>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Handle_Happy_SetsActivoFalseAndReturnsDto()
+    {
+        var now = new DateTime(2026, 4, 15, 10, 0, 0, DateTimeKind.Utc);
+        var afterDeactivation = new DateTime(2026, 4, 15, 13, 0, 0, DateTimeKind.Utc);
+
+        _repository.GetByCodigoAsync("reportes")
+            .Returns(
+                RolActive("reportes", 20),
+                new Rol(20, "reportes", "Nombre", "Desc", false, now, afterDeactivation));
+        _repository.HasActiveUsuariosAsync("reportes").Returns(false);
+        _repository.UpdateAsync("reportes", "Nombre", "Desc", false, Arg.Any<CancellationToken>())
+            .Returns(true);
+
+        var dto = await _handler.Handle(new DeactivateRolCommand("reportes"));
+
+        Assert.Equal(20, dto.Id);
+        Assert.False(dto.Activo);
+        Assert.Equal(afterDeactivation, dto.FechaModificacion);
+    }
+
+    [Fact]
+    public async Task Handle_Happy_CallsUpdateAsyncWithActivoFalse()
+    {
+        var now = new DateTime(2026, 4, 15, 10, 0, 0, DateTimeKind.Utc);
+
+        _repository.GetByCodigoAsync("reportes")
+            .Returns(
+                RolActive("reportes"),
+                new Rol(10, "reportes", "Nombre", "Desc", false, now, now));
+        _repository.HasActiveUsuariosAsync("reportes").Returns(false);
+        _repository.UpdateAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string?>(), Arg.Any<bool>(), Arg.Any<CancellationToken>())
+            .Returns(true);
+
+        await _handler.Handle(new DeactivateRolCommand("reportes"));
+
+        await _repository.Received(1).UpdateAsync("reportes", "Nombre", "Desc", false, Arg.Any<CancellationToken>());
+    }
+}