test: lock Officer Learning API auth and draft persistence

[cursor]

Summary

Yesterday's coverage commit never landed on main. This run re-applies it and adds the next high-risk gaps: Officer Learning Hub API auth/tenancy, shared on-device draft storage, and informal-log permission edges.

Production behavior is unchanged. Tests only.

Risky behavior now covered

• Officer Learning /api/officer-learning/me rejects missing session / incomplete tenant identity (401), invalid JSON and shareWithLocal without Hub sync (400), and writes only under the session unionId/localId (forged body tenant keys cannot create a row in another union).
• Local report/settings routes return 403 for stewards and 401 without a session; a president enabling reporting cannot see another union's opt-in completions.
• Shared completions stay empty for a matching localId in another union and for another local in the same union.
• Device progress state machine: quiz-pass lock, scroll clamp/monotonic depth, corrupt JSON and quota failures.
• Hub sync client does not PUT after a quiz pass unless the account already opted in; hydrate merges Hub → device.
• Proposal Tracker and shared loadJsonDraft/saveJsonDraft reject corrupt or schema-invalid localStorage and return false on quota/private-mode throws (TOOL-001).
• Informal log: local_exec cannot convert to a grievance (including dual steward+exec roles); delete is author-or-elevated; view never crosses unions, even for platform_admin.

Test files added/updated

• src/lib/officer-learning/api-routes.test.ts (new)
• src/lib/officer-learning/hub-store.test.ts
• src/lib/officer-learning/hub-sync-client.test.ts (new)
• src/lib/officer-learning/modules.test.ts (new)
• src/lib/officer-learning/progress.test.ts (new)
• src/lib/officer-learning/parse-module.test.ts
• src/lib/officer-learning/quiz-scroll.test.ts
• src/lib/officer-learning/related-resources.test.ts
• src/lib/proposal-tracker/draft.test.ts (new)
• src/lib/validation/officer-learning.test.ts (new)
• src/lib/rules-of-order/actions.test.ts
• src/lib/steward-guides/storage.test.ts (new)
• src/lib/informal-log/access.test.ts (new)

Why this reduces regression risk

These paths are permissions, tenancy, validation, and persistence — a silent 403/401 miss or a cross-union leak would not show up in smoke locators. The previous coverage PR (cursor/missing-test-coverage-f6b4) never merged; quiz navigation / Hub sync QOL from 2026-08-28 was still untested on main.

Checklist

• No secrets, .env, keys, or real member/PII data
• User-facing strings updated in both messages/en.json and messages/fr.json (if applicable)
• Role/tenancy rules respected (unionId scoping; no cross-union access)
• npm run lint and npm run test:unit pass
• Smoke tests run if UI/routes changed (npm run test:smoke)
• Docs updated if setup/deploy/privacy behaviour changed

Test plan

• npm run test:unit -- src/lib/officer-learning src/lib/steward-guides/storage.test.ts src/lib/informal-log/access.test.ts src/lib/proposal-tracker src/lib/validation/officer-learning.test.ts src/lib/rules-of-order/actions.test.ts — 19 files / 91 tests passed.
• Lint clean on the new and updated test files.
• No production files changed; smoke not required.