VENUS-363 — solicitud padron badge: false no-match on staff requests, collapsed negatives, raw role codes

Found by reading /admin/solicitudes on SOL-VENUS-13 (Elazar: "fix it"). 1. ExpectedMatchBadge rendered "Sin coincidencia en el padron de alumnos" whenever hasDocument && !match. The lookup queries vActiveAlumnos (STUDENT roster), so a titular/bedelia/administrador request can NEVER match — the negative was structurally guaranteed and read as a fraud signal. Fixed: suppress the negative for non-alumno requests; positive hits and risk signals still render. 2. getExpectedAlumnoMatch collapsed FOUR outcomes into null — genuine no-match, ambiguous document (>1 account, highest-risk), DB error, and admin-guard miss — all rendering the same benign badge. Fixed: discriminated ExpectedMatchOutcome (single|none|ambiguous|error|skipped), each rendered distinctly. 3. Raw role codes leaked into Spanish UI: access-request-review.tsx "Rol solicitado: titular" and auth-actions.ts:1144 "ya tiene otro rol (bedelia)". Both now use practica-roles.roleLabel(). NOT changed: the role-shape fail-closed gate at auth-actions.ts:1140. Elazar hit it on SOL-VENUS-13 (account is bedelia, request is titular) but it is gate-correct — a permission change must stay a separate explicit admin action. Class-A. audit-venus-ca PASS on design (audit-venus-ca-msj0ggv29lxy); pre-push diff review pending. 18 new tests, falsification-verified; suite 601/601.