Merge the needs-based onboarding's server state and the derivation that never hides data

src/__tests__/proxy-demo-mode-allowlist.test.ts

@@ -51,6 +51,31 @@ describe("proxy.ts DEMO_MODE mutation allowlist", () => {
     expect(res.status).not.toBe(403);
   });
 
+  it("permits the three setup-flow writes so the demo can finish onboarding", () => {
+    // v1.39 (C1) — the design spec requires the demo to complete the same flow
+    // with preset answers, and none of the three creates health data: closed
+    // enum answers, the step ledger, and the module map derived from them.
+    for (const [path, method] of [
+      ["/api/onboarding/answers", "PATCH"],
+      ["/api/onboarding/complete", "POST"],
+      ["/api/onboarding/restart", "POST"],
+    ] as const) {
+      expect(
+        proxy(makeRequest(path, method)).status,
+        `${method} ${path} is blocked in the demo`,
+      ).not.toBe(403);
+    }
+  });
+
+  it("does not drag in a sibling verb on an allowlisted onboarding path", () => {
+    // The allowlist pins method per path, so admitting the answers PATCH must
+    // not open a DELETE somebody adds to that route later.
+    expect(proxy(makeRequest("/api/onboarding/answers", "DELETE")).status).toBe(
+      403,
+    );
+    expect(proxy(makeRequest("/api/onboarding/step", "POST")).status).toBe(403);
+  });
+
   it("still blocks a health-data mutation (POST /api/measurements)", () => {
     const res = proxy(makeRequest("/api/measurements", "POST"));
     expect(res.status).toBe(403);