approveAccessRequest: docente_jtp/docente_adjunto approvals miss comisionJtps/comisionAdjuntos membership + wrong role (same defect class as PLUTO-566)

approveAccessRequest in src/lib/admin-actions.ts has the same latent defect for docente_jtp and docente_adjunto that PLUTO-566 fixed for docente_ayudante_primera: an approved request with requesterRole=docente_jtp / docente_adjunto assigns the wrong role (hardcoded alumno pre-566 pattern) and never inserts the fraud-sensitive membership row (comisionJtps for jtp, comisionAdjuntos for adjunto). Fix mirrors PLUTO-566: branch on requesterRole, insert the correct membership table in-txn with sentinel archive context, fail-loud on missing comision/periodo, assign the correct role. Paired backfill likely needed (db-pluto-cc) for already-approved rows. Audit-pluto-ca ruled this a separate WI during PLUTO-566 (do not widen 566).