bug(provisioning): approveAccessRequest doesn't copy document into alumno

approveAccessRequest alumno INSERT (auth-actions.ts:925) writes only userId/email/cohortId/role/isActive; reqRow SELECT (:747) never fetches documentoType/documentoNumber. Result: EVERY approve-created alumno has NULL documentoType/documentoNumber (and NULL dni), silently failing the roster-match trust-signal badge that imported alumnos pass. Pre-existing gap, NOT a VENUS-154 rename regression. Fix: SELECT+INSERT doc cols from request, dni=documentoNumber when tipo='dni', ON CONFLICT COALESCE-fill; db backfills affected set from approved requests w/ setArchiveContext. Found via Elazar dupe-check on Rubiño Iriarte, Martina.