test: lock bumping tenancy and auth email/MFA routes

[cursor]

Summary

Daily coverage pass after the 2026-09-07 SMTP diagnostic flatten and a scan of Hub routes that still had no HTTP-layer tests. Adds deterministic unit coverage for college bumping tenancy/write gates, public auth email/reset contracts, and MFA enroll/verify so those regressions fail in CI instead of on a live host.

Risky behavior now covered

• Bumping: 401/403 members; module-disabled tenants; list never includes another union; presidents do not see sister locals; union_admin without a local still cannot read another union; stewards/local_exec can read but not create/patch/notes/decisions/sessions; POST/PATCH reject forged tenant keys and stamp session union/local/author; GET 404 missing / 403 other union including platform_admin with no write; notes/decisions/sessions require fields and ignore forged author IDs; seniority ranking stays advisory, local-scoped, and excludes inactive + other-local rows.
• Auth email (recent production-only flatten): forgot-password / sign-in-email invalid JSON; unknown and demo emails do not enumerate via SMTP diagnostics; known-account send skips flatten smtpHost/smtpPort/smtpFrom/smtpAuthConfigured/smtpJson as strings in audit metadata and never include SMTP_PASS; email-status snapshot has no password; reset-password GET 404/pending and POST consumes a token once.
• MFA routes: 401 without session; enroll 503 unless TOTP mode; pending secret is not persisted until a valid confirm code; verify issues a server-minted grant (not a client mfaVerified boolean); TOTP-without-secret returns needsEnrollment.

Test files added/updated

• src/lib/bumping/api-routes.test.ts (new)
• src/lib/bumping/memory-adapter.ts (resetBumpingMemoryForTests only)
• src/lib/auth/auth-email-routes.test.ts (new)
• src/lib/auth/mfa-routes.test.ts (new)

Why these tests materially reduce regression risk

Bumping is confidential casework with a large blast radius and had no route tests. The 2026-09-07 SMTP flatten only changed production routes — a nested smtp object in audit metadata would 500 durable hosts. MFA verify is the SEC-001 grant boundary; a client-boolean regression would skip the second factor.

Did not duplicate open coverage PRs #57 / #68 / #79 / #80 (expense/elections/documents, polls/check-ins/discussions, tasks/snippets, marketplace/grievance QOL).

Checklist

• No secrets, .env, keys, or real member/PII data
• User-facing strings updated in both messages/en.json and messages/fr.json (if applicable)
• Role/tenancy rules respected (unionId scoping; no cross-union access)
• npm run lint and npm run test:unit pass
• Smoke tests run if UI/routes changed (npm run test:smoke)
• Docs updated if setup/deploy/privacy behaviour changed

Lint: 0 errors (pre-existing warnings only). Unit: 37 new tests + 91 related tests green. No UI/route behavior change — smoke not required. No production behavior change except a test-only bumping memory reset helper.

Test plan

• npx vitest run src/lib/bumping/api-routes.test.ts src/lib/auth/auth-email-routes.test.ts src/lib/auth/mfa-routes.test.ts
• Confirm CI unit job is green before merge.