VENUS-364 — dedup 8 copies of the role-label map onto practica-roles.roleLabel()

Tree-wide grep for "Docente titular" returns 8 independent maps of the same 4 role codes to the same 4 Spanish labels: src/lib/practica-roles.ts:89 (the SSOT — exports roleLabel(), and its own comment already admits the duplication) src/lib/auth-actions.ts:2269 (roleLabels, inline in the copy-analysis blob) src/lib/email.ts:428 (inline ternary) src/app/admin/solicitudes/solicitud-detail.tsx:14 (ROLE_LABELS) src/components/solicitudes-list-client.tsx:32 (ROLE_LABELS) src/app/admin/solicitudes/access-request-review.tsx:47 (ROLE_OPTIONS — value+label, feeds a Select, so it needs the pair not just the label) src/components/access-request-form.tsx:45 (ROLE_OPTIONS) src/app/solicitar-acceso/completar/completar-form.tsx:29 (ROLE_OPTIONS) This duplication is WHY VENUS-363 found two sites rendering the raw code: there was no single thing to reach for, so two surfaces just did not get a label at all. Nothing in a duplicate can go stale loudly — a future role add or label change lands in some of the 8 and not others, and each copy reads correct in isolation. Proposed shape: practica-roles.ts exports both roleLabel(code) and ROLE_OPTIONS (the ordered value+label pairs the Selects need), and the other 7 sites import. Note the Select sites need the ORDERED pair list, so a bare label map is not a sufficient SSOT. Not urgent, no user-visible defect outstanding after VENUS-363. Touches email.ts and auth-actions.ts, so Class-A.