test: lock attachment, time PTO, and mutate HTTP tenancy

[cursor]

Summary

Adds HTTP tenancy and validation tests for confidential attachments, workforce PTO/sites/shifts/export, expense draft mutate, and election nomination mutate — surfaces that previously had adapter-level tests only.

Risky behavior now covered

• Grievance/bumping attachments: unauthenticated/member gates, assigned-steward vs 404 hide, other-union 404 even as platform_admin, sister-local hide, upload stamps case tenant (not the body), scan pending/infected refuse download, attachment/case id mismatch 404, filename quote stripping, bumping steward read-only vs stability_member write, bumping module-off 403
• Time PTO / sites / shifts / export: steward own-only PTO, president local excluding sister/other union, forged workerId ignored, steward cannot approve PTO, steward cannot upsert sites or export, CSV export omits sister-local and other-union rows, unpublished shifts hidden from stewards, time module-off 403
• Expense [id] GET/PATCH/DELETE: members 403, other-union 404, extra keys rejected, submitted drafts locked, steward cannot delete someone else’s draft, president cannot delete after approval
• Election nomination PATCH/DELETE: members/stewards 403, other-union 403 even as platform_admin, sister-local president 403, extra keys 400

Test files added/updated

• src/lib/attachments/api-routes.test.ts (new)
• src/lib/time/pto-sites-export-routes.test.ts (new)
• src/lib/expenses/draft-mutate-routes.test.ts (new)
• src/lib/elections/nomination-mutate-routes.test.ts (new)
• src/lib/attachments/memory-adapter.ts — test-only reset/insert helpers
• src/lib/bumping/memory-adapter.ts — test-only seed reset (same helper as open PR test: lock bumping tenancy and auth email/MFA routes #82)

Why these tests materially reduce regression risk

These routes are the remaining high-blast-radius HTTP gaps after coverage PRs #57–#84: case evidence files, PTO/export (payroll-adjacent), and money/election mutations. A tenancy or scan-gate slip here leaks across unions or serves an unscanned file. Adapter unit tests never exercised require*Session, 404-vs-403 hide, or session-stamped tenant ids.

Does not duplicate open coverage PRs #57, #68, #79, #80, #82, #83, or #84.

Checklist

• No secrets, .env, keys, or real member/PII data
• User-facing strings updated in both messages/en.json and messages/fr.json (if applicable) — N/A tests only
• Role/tenancy rules respected (unionId scoping; no cross-union access)
• npm run lint and npm run test:unit pass
• Smoke tests run if UI/routes changed (npm run test:smoke) — N/A no production behavior change
• Docs updated if setup/deploy/privacy behaviour changed — N/A

Test plan

npm run test:unit -- src/lib/attachments/api-routes.test.ts src/lib/time/pto-sites-export-routes.test.ts src/lib/expenses/draft-mutate-routes.test.ts src/lib/elections/nomination-mutate-routes.test.ts src/lib/time src/lib/grievance src/lib/bumping src/lib/attachments src/lib/expenses src/lib/elections

All 147 targeted tests passed. Lint clean on touched files (pre-existing repo warnings only).