feat(api): UDT-004 controller de roles + refactor validator UDT-003 a lookup dinamico

- RolesController /api/v1/roles CRUD admin-only: GET list, GET {codigo}, POST, PUT, DELETE (soft-delete con guard 409)
- ExceptionFilter: mapea RolNotFound (404), RolAlreadyExists (409), RolInUse (409)
- DI: registra 5 handlers de Roles (Application) y IRolRepository/RolRepository (Infrastructure)
- CreateUsuarioCommandValidator: reemplaza whitelist hardcoded por IRolRepository.ExistsActiveByCodigoAsync via MustAsync; constructor recibe (AuthOptions, IRolRepository)
- Tests: 202 verdes (173 application + 29 api). Nuevas: RolesEndpointTests (13 integration), CreateUsuarioCommandValidatorTests reescrito con NSubstitute mock, CreateUsuario_WithInactiveRol_Returns400 en Api.Tests
- Fix: ApiIntegration pasa de IClassFixture (N factories) a ICollectionFixture (1 factory shared) — evitaba ObjectDisposedException sobre RSABCrypt al compartir coleccion con multiples test classes
- tests/tests.runsettings: MaxCpuCount=1 para evitar race entre assemblies sobre SIGCM2_Test

tests/SIGCM2.Api.Tests/ApiIntegrationCollection.cs

@@ -0,0 +1,20 @@
+using SIGCM2.TestSupport;
+using Xunit;
+
+namespace SIGCM2.Api.Tests;
+
+/// <summary>
+/// Shared collection for all Api integration tests.
+/// Uses ICollectionFixture so a SINGLE TestWebAppFactory (and its RSA key singleton)
+/// is shared across all test classes in the "ApiIntegration" collection.
+///
+/// Previously each class used IClassFixture which spawned one factory per class;
+/// that created N factories sequentially in the same process, and the RSA key
+/// singleton from an earlier factory could leak into a later factory's DI graph
+/// (producing ObjectDisposedException "RSABCrypt" on first signing).
+/// </summary>
+[CollectionDefinition("ApiIntegration")]
+public sealed class ApiIntegrationCollection : ICollectionFixture<TestWebAppFactory>
+{
+    // Intentionally empty: this class only exists to declare the collection/fixture binding.
+}