feat: complete fase 1 - all controllers, services, middleware

- Added Ejecutivo.cs entity
- ArqueoService + ArqueoController (arqueos por fecha/usuario)
- 13 missing controllers: Curso, Descuento, Documento, Empresa, Horario,
  Jornada, Programa, Propuesta, Region, Sala, Sede, Tarifa, Usuario
- JwtMiddleware.cs for cookie/token validation
- SpComplexQueries.cs for Dapper multi-resultset
- ArqueoService registered in DI
- Build: 0 errors
- Total: 21 controllers, 8 services, 7 repos, 21 entities

backend/src/Ventas.API/Controllers/CursoController.cs

@@ -0,0 +1,47 @@
+using Dapper;
+using Npgsql;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Ventas.API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+[Authorize]
+public class CursoController : ControllerBase
+{
+    private readonly string _connectionString;
+
+    public CursoController(IConfiguration configuration)
+    {
+        _connectionString = configuration.GetConnectionString("Default")!;
+    }
+
+    private async Task<IEnumerable<Dictionary<string, object>>> QuerySpAsync(string sp, object parameters)
+    {
+        using var connection = new NpgsqlConnection(_connectionString);
+        var rows = await connection.QueryAsync(sp, parameters, commandType: System.Data.CommandType.StoredProcedure);
+        return rows.Select(r => (Dictionary<string, object>)(IDictionary<string, object>)r!);
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> Buscar([FromQuery] string tipoBusqueda, [FromQuery] string nombre)
+        => Ok(await QuerySpAsync("sige_sam_v3.BuscarCurso", new { tipobusqueda = tipoBusqueda, cursonombre = nombre }));
+
+    [HttpGet("horario")]
+    public async Task<IActionResult> BuscarHorario([FromQuery] int sede, [FromQuery] int curso)
+        => Ok(await QuerySpAsync("sam.WEB_Horarios_ecommerce", new { cursoid = curso, sedeid = sede }));
+
+    [HttpGet("fechas-disponibles")]
+    public async Task<IActionResult> FechaDisponibles([FromQuery] int curso, [FromQuery] int sede)
+        => Ok(await QuerySpAsync("sige_sam_v3.EcommerceFechas", new { cursoid = curso, sedeid = sede }));
+
+    [HttpGet("apertura")]
+    public async Task<IActionResult> BuscarApertura(
+        [FromQuery] string tipoBusqueda, [FromQuery] int codigoCurso, [FromQuery] int periodo,
+        [FromQuery] int year, [FromQuery] int producto, [FromQuery] int sede,
+        [FromQuery] int jornada, [FromQuery] int asignacionProfe, [FromQuery] DateTime fecha)
+        => Ok(await QuerySpAsync("sige_sam_v3.BuscarCursosAperturados",
+            new { tipobusqueda = tipoBusqueda, codigocurso = codigoCurso, periodo, yearperiodo = year,
+                producto, sede, jornada, asignacion = asignacionProfe, fechatermino = fecha }));
+}