Marc-André Bombeck 433d983e60 test(auth): pin the step-up elevation boundary and publish its contract ...

Adds the structural guard that freezes the exact route set an elevation can
unlock, plus the behavioural suite that drives each threat case against a real
Postgres: a token alone mints nothing, an elevation minted for one token is
refused for another (same account included), a second redemption fails, a
concurrent redemption lets exactly one winner through, an expired one is
refused, an elevation never reaches requireAdmin, a wrong password is throttled
and audited without saying what was wrong, and the cookie flow is untouched.

The OpenAPI registry carries both new routes and names the accepting set in
prose, so the client implements against the contract rather than against a
description of it.

2026-07-19 12:47:04 +02:00

..

integration

test(auth): pin the step-up elevation boundary and publish its contract

2026-07-19 12:47:04 +02:00