[Test] Integration test suite — checkout full lifecycle

[maxzaikin]

Summary

Implement end-to-end integration tests for the complete
checkout workflow against real running services.

Context

See Workflow-Checkout

Acceptance Criteria

• Test infrastructure: docker-compose.test.yml spins up all services
• Test: full ROTATION_TASK lifecycle
  Create tenant → create user → assign role + scope →
  create asset + credential → create task → owner approve →
  operator starts → MFA → Dual Control → password display →
  checkin → verify password updated in DB
• Test: full ACCESS_TASK lifecycle
  Same as above + verify auto ROTATION_TASK created after completion
• Test: scope violation → 403 + CRITICAL audit event created
• Test: Dual Control self-approval → 403 + audit event created
• Test: checkout without active task → 422
• Test: password display increments view_count
• Test: second password display generates WARN audit event
• Test: checkout TTL expiry → status EXPIRED
• Each test verifies audit events in all three databases
• Each test verifies X-Request-ID correlation across audit logs