test(persona): MEMBER Login-only ESS HTTP is 200; payroll runs 403

[jason931225]

Draft. Independent review required before merge.

Candidate SHA: 5f79af7766ef3b5220f5317a8f9d83ae189e7763
Base: 2f99f9ea26b0813e8962c22a2e74f6376530e69b (origin/main)

MEMBER JWT Login-only (empty feature_grants: no PayrollRunRead, no AttendanceExceptionManage) on the assembled router:

• GET /api/v1/me/inbox-docs?filter=payslip → 200 (empty or own docs), not 403
• GET /api/v1/attendance/me/exceptions → 200, not 403 (date selector is list validation, not an authz grant)
• GET /api/v1/payroll/runs → 403

Status lock only. Does not duplicate #900 payslip emit. Does not edit attendance_persona_api.rs, action_inbox_api.rs, or inbox/rest/tests/api.rs. Cargo auto-discovers backend/app/tests/persona_ess_http.rs; Cargo.toml/lock untouched.

Lease: backend/app/tests/persona_ess_http.rs only. Disjoint from identity/directory (#897/#908/#909), canonical adapters (#898), action-inbox (#899), inbox-payslip-filter (#900), attendance personas (#903), auth cookies (#904), FE/UI (#905), and attendance CONFIRM parse (#907).

Tests

SQLX_OFFLINE=true tools/lanes/pgtest.sh . cargo test --locked -p console-app --test persona_ess_http -- --test-threads=1 --nocapture

discovered 1, executed 1, passed 1.

HOLDs

• docs/program/executed-tests-baseline.json not updated (feat(ui): Leptos 0.9 SSR payroll vertical (stacked on GATE) #905 owns it). New #[sqlx::test] is a new binary console-app --test persona_ess_http; the executed-tests ratchet may require --update / CI wiring on that lane.
• Not merge/release. No live promo.

merge-tree --write-tree (all exit 0)

• vs origin/main
• vs PR 897 c9d8c558
• vs PR 898 e390a25e
• vs PR 899 f861f715
• vs PR 900 152ca5cb
• vs PR 903 5d30ddec
• vs PR 904 e5164a42
• vs PR 905 0c2b572c
• vs PR 907 b3dccd2b
• vs PR 908 44dbf184
• vs PR 909 d8100a9b

Blast radius / rollback

• New integration test file only. Rollback is revert of this commit. No schema, lockfile, OpenAPI, CI, or runtime change.

No merge.

[jason931225]

Status after working the 16-PR queue:

• feat(ui): Leptos 0.9 SSR payroll vertical (stacked on GATE) #905 closed (frontend HOLD). It was the exclusive writer of docs/program/executed-tests-baseline.json, which is why this PR's preflight is red: gained declared test attributes / new binary without check-executed-tests --update.
• Vacuous occupancy closed: fix(attendance): omit empty own-exception evidence JSON key #914 (OpenAPI-required evidence), test(ontology): free-text org-unit labels never mint authority #915 (unused parser), test(attendance): lock MEMBER JWT empty grants on self-read #920 (403 || 404), test(identity): same-org peer omit for workspace layouts #925 (SQL count of a never-inserted row).
• Remaining serial: one writer on the baseline. This PR stays draft until restacked on current main with --update and a named probe that is red on that tip. Do not spawn a sibling.