test(plugin-auth): resolve @objectstack/formula's TYPES to source too

The sibling gate `check:type-source-resolution` is red on the same specifier,
and it is red at the PR head `b65fafc81` as well -- measured with both files of
the alias fix-up reverted in place under a trap, then restored byte-identical.
It was invisible only because `Lint & Repo Gates` halts at step 130
(`Test-source alias gate`) and skips 131-148; this gate is step 132, so
unblocking 130 walks the job straight into it.

Same defect class, same specifier, same round-1 import (`celEngine`), and the
remedy the gate dictates: ONE `paths` rule for the bare name in the package's
`tsconfig.json`, copied in shape from the `@objectstack/service-messaging` rule
already beside it. `@objectstack/formula` publishes no subpath in its `exports`,
so a subpath rule would match nothing on disk and fall back to node resolution.
`tsconfig.test.json` inherits this map rather than declaring its own, which is
what carries the rule to the test layer that reaches the specifier.

Measured rather than assumed, because #12570 records this exact rule billing
another package's source diagnostics into this ledger:

- `check:type-source-resolution` 0 -- "125 tsc program(s) across 78 packages
  scanned; 61 registered as still resolving a workspace dep's types through
  `dist/`".
- `pnpm --filter @objectstack/plugin-auth typecheck` 0, with
  `check:test-typecheck` reporting the ledger UNCHANGED at 10 file(s) /
  94 error(s) / 23 pinned signature(s) -- nothing was added to it.
- `tsc -p tsconfig.test.json --listFiles`: 15 `packages/formula/src/*.ts` files
  now in the program, 0 files under `packages/formula/dist/`, program 1243 ->
  1257 files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Author: claude

packages/plugins/plugin-auth/tsconfig.json

@@ -27,6 +27,18 @@
     // — that package declares none — and a `paths` target matching nothing on
     // disk would silently fall back to node resolution.
     "paths": {
+      // [#15136] `@objectstack/formula` is imported as a VALUE by
+      // `src/session-positions-security-axis.test.ts` (`celEngine`, the real CEL
+      // engine the server evaluates formulas and RLS with — the pins drive it
+      // rather than a fixture because the defect lived in the seam). Same
+      // mechanism as the entry below and the same ONE-rule shape: the test layer
+      // reaches this specifier through `tsconfig.test.json`, which inherits this
+      // map rather than declaring its own, and `@objectstack/formula` publishes
+      // no subpath in its `exports`, so a subpath rule would match nothing on
+      // disk and fall back to node resolution. Without it tsc resolves the
+      // specifier to `dist/index.d.ts` — a BUILD ARTIFACT — which
+      // `check:type-source-resolution` refuses.
+      "@objectstack/formula": ["../../formula/src/index.ts"],
       "@objectstack/service-messaging": ["../../services/service-messaging/src/index.ts"]
     }
   },