[Test] Security test suite — authorization and audit integrity

[maxzaikin]

Summary

Implement security-focused tests verifying that all
authorization controls are enforced and audit trail is complete.

Context

See Security-Authorization-Model and
Security-Audit-Model

Acceptance Criteria

• Test: Operator cannot access Admin endpoints → 403
• Test: Auditor cannot perform any write operations → 403
• Test: User with no scope cannot checkout any asset → 403
• Test: Admin cannot bypass Dual Control → 403
• Test: Dual Control same user → CRITICAL audit event in secrets_audit
• Test: Approval token used twice → CRITICAL audit event
• Test: Approval token opened by wrong user → CRITICAL audit event
• Test: Audit table has no UPDATE grants → verify via pg_catalog
• Test: Audit table has no DELETE grants → verify via pg_catalog
• Test: Every checkout generates events in all three audit DBs
• Test: JWT blocklist — revoked token returns 401 immediately
• Test: Force logout → all sessions invalidated within 1 request
• Test: AES-256-GCM tampered ciphertext throws on decrypt
• Test: MFA token cannot be used by different user