usuarios: DB-backed regression tests for updateAlumno/tier authz matrix

Audit post-push follow-up (MARS-usuarios ea68430/v2.56.0). Cover: two-SA partial scope, slot-only source edit, cross-comisión target denial, closed-source denial (admin AND teacher), surrogate actor, stale expectedUpdatedAt, malformed uuid. Duplicated SQL across tier/decorator/roster-read/write must stay aligned — regression coverage is the guard.