test: lock informal-log tenancy, convert, and request validation

[cursor]

Summary

Adds unit coverage for Informal Log Hub routes, session filters, and Zod request guards. Prior coverage PRs (#25/#26) are still draft and focused on Officer Learning; this run covers the next high-risk gap — convert-to-grievance and cross-union isolation on /api/informal-log.

Production behavior is unchanged aside from a test-only memory-store reset helper.

Risky behavior now covered

• List/create/get/patch/delete/convert return 401 without a session and 403 for members; local_exec (including dual steward+exec) cannot convert a log into a grievance.
• List never includes another union or another local for a steward; get/convert of a foreign-union id is 404 even for platform_admin.
• Create rejects forged unionId/localId in the body and stamps the session tenant.
• Patch of an already-converted log is 409; unknown/tenant keys on update fail validation (including convertedToGrievanceId).
• Delete is author-or-elevated: another steward gets 403; the author can delete.
• Convert creates a Step 1 grievance on the log's union/local, seeds the conversion note, then 409s on retry; a tenant with Informal Log but no grievance module gets 403.
• Session filters: missing unionId lists __none__; stewards stay pinned to local/collection; cross-local admins drop those filters only when localId is empty.

Test files added/updated

• src/lib/informal-log/api-routes.test.ts (new)
• src/lib/informal-log/session.test.ts (new)
• src/lib/informal-log/access.test.ts (new)
• src/lib/validation/informal-log.test.ts (new)
• src/lib/informal-log/memory-adapter.ts — resetInformalLogMemoryForTests() only

Why this reduces regression risk

These paths are permissions, tenancy, and validation. A silent 403 miss, a convert that files into the wrong union, or a list that leaks another local would not show up in smoke locators. The previous coverage PRs never merged Informal Log route tests.

Checklist

• No secrets, .env, keys, or real member/PII data
• User-facing strings updated in both messages/en.json and messages/fr.json (if applicable)
• Role/tenancy rules respected (unionId scoping; no cross-union access)
• npm run lint and npm run test:unit pass
• Smoke tests run if UI/routes changed (npm run test:smoke)
• Docs updated if setup/deploy/privacy behaviour changed

Test plan

• npx vitest run src/lib/informal-log src/lib/validation/informal-log.test.ts src/lib/hub/demo-collection-seed.test.ts src/lib/grievance src/lib/validation — 7 files / 53 tests passed.
• ESLint clean on the new and updated files.
• No UI change; smoke not required.