feat(api): UDT-004 dominio + repositorio + application roles (tdd)

- Migraciones V003 (tabla Rol + 8 seeds canonicos) y V004 (drop CK + FK Usuario.Rol)
- Dominio: Rol entity + 3 excepciones (RolNotFound/AlreadyExists/InUse)
- Infraestructura: RolRepository (Dapper) con List/Get/ExistsActive/Add/Update/HasActiveUsuarios
- Application: CRUD queries y commands (List, Get, Create, Update, Deactivate) + validators (codigo regex ^[a-z][a-z0-9_]*$)
- Validator UDT-003: whitelist alineada a codigos canonicos (full IRolRepository lookup diferido a Phase 5.1)
- Tests: 169 application + 15 api (todos verdes). Respawn configurado para re-seedear Rol canonical post-reset.
- Estricto TDD: RED/GREEN/TRIANGULATE en todos los handlers nuevos.

tests/SIGCM2.Application.Tests/Roles/Get/GetRolByCodigoQueryHandlerTests.cs

@@ -0,0 +1,43 @@
+using NSubstitute;
+using SIGCM2.Application.Abstractions.Persistence;
+using SIGCM2.Application.Roles.Get;
+using SIGCM2.Domain.Entities;
+using SIGCM2.Domain.Exceptions;
+
+namespace SIGCM2.Application.Tests.Roles.Get;
+
+public class GetRolByCodigoQueryHandlerTests
+{
+    private readonly IRolRepository _repository = Substitute.For<IRolRepository>();
+    private readonly GetRolByCodigoQueryHandler _handler;
+
+    public GetRolByCodigoQueryHandlerTests()
+    {
+        _handler = new GetRolByCodigoQueryHandler(_repository);
+    }
+
+    [Fact]
+    public async Task Handle_ExistingCodigo_ReturnsDto()
+    {
+        var now = new DateTime(2026, 4, 15, 10, 0, 0, DateTimeKind.Utc);
+        _repository.GetByCodigoAsync("cajero").Returns(new Rol(5, "cajero", "Cajero", "Desc", true, now, null));
+
+        var dto = await _handler.Handle(new GetRolByCodigoQuery("cajero"));
+
+        Assert.Equal(5, dto.Id);
+        Assert.Equal("cajero", dto.Codigo);
+        Assert.Equal("Cajero", dto.Nombre);
+        Assert.True(dto.Activo);
+    }
+
+    [Fact]
+    public async Task Handle_NonExistentCodigo_ThrowsRolNotFoundException()
+    {
+        _repository.GetByCodigoAsync("missing").Returns((Rol?)null);
+
+        var ex = await Assert.ThrowsAsync<RolNotFoundException>(
+            () => _handler.Handle(new GetRolByCodigoQuery("missing")));
+
+        Assert.Equal("missing", ex.Codigo);
+    }
+}