feat(api): RequirePermissionAttribute + PermissionAuthorizationHandler [UDT-006]

src/api/SIGCM2.Api/Program.cs

@@ -1,5 +1,7 @@
+using Microsoft.AspNetCore.Authorization;
 using Serilog;
 using Scalar.AspNetCore;
+using SIGCM2.Api.Authorization;
 using SIGCM2.Application;
 using SIGCM2.Infrastructure;
 using SIGCM2.Api.Filters;
@@ -21,6 +23,10 @@ builder.Host.UseSerilog((ctx, lc) => lc
 builder.Services.AddApplication();
 builder.Services.AddInfrastructure(builder.Configuration);
 
+// Authorization — handler lives in Api layer; DO NOT move to Infrastructure DI
+builder.Services.AddAuthorization();
+builder.Services.AddScoped<IAuthorizationHandler, PermissionAuthorizationHandler>();
+
 // Controllers with exception filter
 builder.Services.AddControllers(opts =>
 {