feat(api): PermissionAuthorizationHandler resuelve overrides desde DB por request [UDT-009]

tests/SIGCM2.Api.Tests/Usuarios/CreateUsuarioEndpointTests.cs

@@ -225,7 +225,8 @@ public sealed class CreateUsuarioEndpointTests : IAsyncLifetime
                 new { Username = newUsername });
 
             Assert.True(row.Activo, "Activo should be true");
-            Assert.Equal("[]", row.PermisosJson);
+            // V009 (UDT-009): ForCreation now defaults to canonical shape {"grant":[],"deny":[]}
+            Assert.Equal("""{"grant":[],"deny":[]}""", row.PermisosJson);
         }
         finally
         {