Adds the missing Management/UI P0 e2e tests the coverage registry enumerates but
nothing covered: budget-create persistence read back through /budget/info,
proxy-admin-only enforcement on /budget/new and /team/new, and team-admin-required
enforcement on /team/member_add and /team/member_delete. Each authz test also
asserts the write did not land, so a removed check fails the test rather than
passing on the status code alone
Reconciles the covers markers already on the suite to real registry ids so the
collector counts them instead of flagging orphans: management.team.new.persists to
mgmt.team.new.persists, mgmt.user.new.persists to mgmt.user.new.happy_path,
mgmt.organization.new.persists to mgmt.organization.new.happy_path, and the
route-scoped llm-only-key denial to other.auth.virtual_key.route_permission_enforced,
which is the contract it actually proves. The key-generate test additionally claims
mgmt.key.info.persists and the member add/delete test claims
mgmt.team.member_delete.persists, both of which they already assert
This raises Management/UI P0 coverage from 4/19 to 13/19. The remaining gaps are the
three key.*.admin_only cells (internal users self-serve keys, so "admin_only" is the
wrong framing and needs a registry decision), the SSO-driven key.generate.happy_path,
and the model.* cells handled on the model-management fold branch
* test(e2e): add management suite covering key/team/user/org lifecycle and route permissions
* test(e2e): decouple the enforcement-flip assertion from upstream health
Polling for a 200 on the newly-allowed model required it to be a routable,
healthy upstream, which is not the contract under test; poll until the
key_model_access_denied 403 lifts instead, excluding 401 so a revoked key
cannot read as success. Also document that the delete test's deferred teardown
firing on an already-deleted key is deliberate: cleanup must survive the test
failing before the in-body delete, and the repeat delete is a warn-free no-op
(the proxy answers 404 No keys found)
* test(e2e): inline the management suite's model and tpm literals
* test(e2e): drop the models_mgmt suite line from the folder list
* test(e2e): write the tpm limit as a plain integer literal
