test: lock expense list, election tallies, and document vault tenancy

[cursor]

Summary

After #44, expense approve/deny, election promote, ledger CRUD, and document download had route tests — but list/create/submit, nominations/tallies, and vault upload/delete still only had the static require*Session marker scan. This run locks those mutating Hub paths so a tenancy or Zod regression cannot ship unnoticed.

Risky behavior now covered

• Expenses: list never leaks another union or local; mine=1 pins to the session user; unknown status is ignored; create rejects forged tenant keys and stamps session union/local/submitter as a draft; create 400 without a local; submit 404s another union (including platform_admin) without changing status; another steward cannot submit someone else's draft.
• Elections: list never leaks another union or local; create rejects tenant keys and stamps the session tenant; nominations 404 missing / 403 other union with no write; extra nomination keys 400; tallies reject negative votes, refuse another union, then record votes and mark the cycle tallied.
• Documents: list never leaks another union; stewards stay pinned to their local; union_admin with an empty local still cannot see another union; upload ignores forged union/local/uploader keys and stamps the session; sizeBytes mismatch 400; delete 404s another union; a steward cannot delete a peer's file.

Test files added/updated

• src/lib/expenses/api-routes.test.ts
• src/lib/elections/api-routes.test.ts
• src/lib/documents/api-routes.test.ts
• src/lib/validation/elections.test.ts

Why this reduces regression risk

These are money, officer-election, and confidential-file routes. A missed unionId filter or a spread of a raw body onto create would leak or write across tenants. The new tests exercise the real route handlers (not just access helpers) so session gating, Zod .strict(), and adapter writes stay aligned.

No production behavior changed.

Checklist

• No secrets, .env, keys, or real member/PII data
• User-facing strings updated in both messages/en.json and messages/fr.json (if applicable)
• Role/tenancy rules respected (unionId scoping; no cross-union access)
• npm run lint and npm run test:unit pass
• Smoke tests run if UI/routes changed (npm run test:smoke)
• Docs updated if setup/deploy/privacy behaviour changed

Test plan

• npx vitest run src/lib/expenses/api-routes.test.ts src/lib/elections/api-routes.test.ts src/lib/documents/api-routes.test.ts src/lib/validation/elections.test.ts (37 passed)
• npx eslint on the four touched test files (clean)
• Smoke not required (tests only; no UI/route production changes)