feat(api): login response permisos desde RolPermiso [UDT-006]

src/api/SIGCM2.Application/Auth/Login/LoginCommandHandler.cs

@@ -1,4 +1,3 @@
-using System.Text.Json;
 using SIGCM2.Application.Abstractions;
 using SIGCM2.Application.Abstractions.Persistence;
 using SIGCM2.Application.Abstractions.Security;
@@ -17,6 +16,7 @@ public sealed class LoginCommandHandler : ICommandHandler<LoginCommand, LoginRes
     private readonly IRefreshTokenGenerator _refreshGenerator;
     private readonly IClientContext _clientContext;
     private readonly AuthOptions _authOptions;
+    private readonly IRolPermisoRepository _rolPermisoRepository;
 
     public LoginCommandHandler(
         IUsuarioRepository repository,
@@ -25,7 +25,8 @@ public sealed class LoginCommandHandler : ICommandHandler<LoginCommand, LoginRes
         IRefreshTokenRepository refreshRepository,
         IRefreshTokenGenerator refreshGenerator,
         IClientContext clientContext,
-        AuthOptions authOptions)
+        AuthOptions authOptions,
+        IRolPermisoRepository rolPermisoRepository)
     {
         _repository = repository;
         _hasher = hasher;
@@ -34,6 +35,7 @@ public sealed class LoginCommandHandler : ICommandHandler<LoginCommand, LoginRes
         _refreshGenerator = refreshGenerator;
         _clientContext = clientContext;
         _authOptions = authOptions;
+        _rolPermisoRepository = rolPermisoRepository;
     }
 
     public async Task<LoginResponseDto> Handle(LoginCommand command)
@@ -59,8 +61,10 @@ public sealed class LoginCommandHandler : ICommandHandler<LoginCommand, LoginRes
             _clientContext.Ip, _clientContext.UserAgent);
         await _refreshRepository.AddAsync(entity);
 
-        var permisos = JsonSerializer.Deserialize<string[]>(usuario.PermisosJson)
-                       ?? Array.Empty<string>();
+        // UDT-006: permisos vienen de RolPermiso, no de Usuario.PermisosJson
+        // Usuario.PermisosJson queda reservado para UDT-008 (overrides por usuario)
+        var permisoEntities = await _rolPermisoRepository.GetByRolCodigoAsync(usuario.Rol);
+        var permisos = permisoEntities.Select(p => p.Codigo).ToArray();
 
         return new LoginResponseDto(
             AccessToken: accessToken,