Authorization, admin, positions, and transfer integration tests

[pataniaeli]

Ticket: AUTH-T95 · Epic: E13 Testing & QA · Phase: Phase 2 — Admin, Primary Admin, positions, UI, SDK, VaultZ
Priority: High · Estimate: 3 points · Labels: epic:testing, phase:2, testing, admin

Depends on:

• Test harness: vitest, Neon test branch, factories, and test mailer #105 — AUTH-T93 Test harness: vitest, Neon test branch, factories, and test mailer
• Admin user-management endpoints #48 — AUTH-T36 Admin user-management endpoints
• Primary Admin transfer flow (re-auth, recipient acceptance, 24-hour cancel window) #49 — AUTH-T37 Primary Admin transfer flow (re-auth, recipient acceptance, 24-hour cancel window)
• Positions CRUD: create, edit name/category, soft delete with retirement #54 — AUTH-T42 Positions CRUD: create, edit name/category, soft delete with retirement
• Position assignment endpoints (assign, unassign, bulk) #55 — AUTH-T43 Position assignment endpoints (assign, unassign, bulk)

HTTP-level tests exercising the admin endpoints with the full actor/target matrix, the position lifecycle (create/rename/assign/delete/retired-key reuse), and the complete PA transfer state machine including cron execution and mid-flight recipient deactivation.

Acceptance criteria

• Matrix and state-machine tests pass; coverage of authz.ts and the transfer service ≥ 90%.

_{Generated from the SGAuth design (docs/sgauth-design in SGAOperations/auth). SGAuth is built on Neon and does not use Supabase.}