test: approve-path doc-carry coverage (approveAccessRequest → alumno)

VENUS-157 fixed approveAccessRequest to carry documentoType/documentoNumber/dni into the alumno, but there is no approve-path unit test (submit path has one). Add coverage: fresh-INSERT carries doc cols + tipo-guarded dni; ON CONFLICT COALESCE existing-wins (never clobbers admin correction on re-approve); pasaporte leaves dni NULL. Audit's non-blocking flag on 641410f.