Sub-ticket of MARS-188 Server-enforce role-required access-request fields: submitAccessRequest only hard-validates 6 always-fields; legajo/programa/comision/jtp rely on browser-only required (latent direct-POST bypass). Add server-side detectMissingFields(role) reject in submit. + add audit .md rule: any client-required field must be server-enforced (front/back contract). · mars