feat(api): PUT /api/v1/users/{id}/permisos/overrides + excepciones domain + ExceptionFilter [UDT-009]

src/api/SIGCM2.Domain/Exceptions/InvalidPermisoCodesException.cs

@@ -0,0 +1,16 @@
+namespace SIGCM2.Domain.Exceptions;
+
+/// <summary>
+/// UDT-009: Thrown when grant or deny arrays contain codes not in the Permiso catalog.
+/// Maps to 400 { title: "invalid-permiso-codes", invalidCodes: [...] }.
+/// </summary>
+public sealed class InvalidPermisoCodesException : Exception
+{
+    public IReadOnlyList<string> InvalidCodes { get; }
+
+    public InvalidPermisoCodesException(IReadOnlyList<string> codes)
+        : base($"Códigos de permiso inexistentes en el catálogo: {string.Join(", ", codes)}")
+    {
+        InvalidCodes = codes;
+    }
+}