test: lock marketplace and grievance QOL tenancy

[cursor]

Summary

After #79 (tasks/snippets), Hub route tests still skipped the within-union marketplace and grievance communications, meetings, notes, and outcomes — those mutating paths only had adapter and access-helper coverage. This run locks those Officer Hub surfaces so a tenancy, assignment, or forged-author regression cannot ship unnoticed.

PRs #57 (expense/elections/documents list-create), #68 (polls/check-ins/discussions), and #79 (tasks/snippets) are still open and are not duplicated here. Today's public Guides catalog and nav IA already ship with registry and smoke coverage.

Risky behavior now covered

• Marketplace: list never leaks another union and still shares sister locals in the same union; kind and q filters work; create rejects missing fields and stamps session union/local/author even when the body forges tenant keys; steward can publish; local_exec and members cannot; GET 404 missing / 403 another union (including platform_admin) with no write; sister-local download allowed; steward can delete own template but not another officer's; president can delete another's.
• Grievance communications / meetings / notes / outcome: assigned steward reads their case and is 403 on another steward's; president reads local cases and not another local; GET 404 missing / 403 another union with no write; posts stamp the case tenant and session author and ignore forged keys; meetings return ICS; notes reject a blank body; outcome Zod rejects extra tenant keys then records the session officer; steward cannot write an unassigned case; local_exec cannot write communications.

Test files added/updated

• src/lib/marketplace/api-routes.test.ts
• src/lib/grievance/api-routes.test.ts
• src/lib/marketplace/memory-adapter.ts (test reset helper only)

Why this reduces regression risk

Marketplace templates and grievance comms/meetings/notes/outcomes are confidential officer writes. A missed unionId check, a steward logging on someone else's case, or a POST that copied unionId / recordedById from the body would leak or re-home records across tenants. The new tests exercise the real route handlers (not just access helpers) so session gating and session-stamped writes stay aligned.

Checklist

• No secrets, .env, keys, or real member/PII data
• User-facing strings updated in both messages/en.json and messages/fr.json (if applicable)
• Role/tenancy rules respected (unionId scoping; no cross-union access)
• npm run lint and npm run test:unit pass
• Smoke tests run if UI/routes changed (npm run test:smoke)
• Docs updated if setup/deploy/privacy behaviour changed

Test plan

• npx vitest run src/lib/marketplace/api-routes.test.ts src/lib/grievance/api-routes.test.ts src/lib/qol/adapters.test.ts src/lib/validation/validation.test.ts src/lib/hybrid/api-routes.test.ts src/lib/handoff/api-routes.test.ts (56 passed)
• npx eslint on the three touched files (clean)
• Smoke not required (no UI; reset helper is test-only)