Prácticas: enforce operador/asistente role separation once rosters are curated (students can't pick a docente as asistente)

Surfaced by the Matías Wang case (SOP-4): a docente_ayudante_primera was recorded as a student asistente on a práctica. Root issue (Elazar): the real fix is NOT that he was mis-picked - it's that once rosters are curated (docentes are docentes, students are students), the práctica participant picker must ENFORCE role separation so a student cannot select a docente as asistente/operador, and only students appear as selectable participants. Design the enforcement: constrain the operador/asistente selectable set to active students in the relevant comisión roster; reject/hide docente-role users. NEEDS A BIGGER TALK WITH CLIENT before implementing (defines the exact role/roster rules). Related: PLUTO-78 (duplicate practicas), PLUTO-508. Blocked on client discussion.