test(e2e): Phase 23B — rebuild E2E infrastructure; fix 6 real prod defects it exposed

Phase 23 closed as PARTIAL: fake coverage was gone, but the E2E layer itself
was still empty — no conftest.py anywhere, ~15 fixtures that never existed,
6 files crashing at import on os.environ["E2E_PASSWORD"], and CI never ran E2E.
STATUS's "10 E2E files / ~80+ cases ✅" described files that had never executed.

Infrastructure delivered:
- tests/e2e/conftest.py: ApiClient (trust_env=False — a host http_proxy turns
  localhost calls into 502), operator_token(username) / new_user / admin_token
  fixtures, and a session probe that calls pytest.exit(4) when the stack is
  unreachable. NOT skip: skip would launder "did not run" into "passed".
- pytest.ini, tests/e2e/requirements.txt, and tests/e2e/sql/
  seed_e2e_operators.sql — migrations contain NO operator seed at all, so a
  fresh database has zero logins; the seed creates 6 e2e accounts with role
  bindings, idempotent, password injected via `psql -v pwd`.
- CI job `e2e`: compose up -> poll /health/live (timeout = fail) -> seed ->
  pytest -> always teardown. Gate D-23-D is now closed.
- 8 E2E files migrated off import-time env reads; tautological assertions
  (`x == t or not x`), a counselor token standing in for content_editor, and a
  bare `status_code == 200` claiming to prove INV-020 were replaced with real
  permission/behavior assertions.

Six real production defects found only by running against real PostgreSQL
(H2 has zero coverage for all of them):
- D-23B-A (Critical): stale V042__add_appointment_operator_register_permission.sql
  left in target/classes; src had replaced it with V042__add_service_location_
  announcements.sql. Packing without clean put two V042 in the jar -> Flyway
  "Found more than one migration with version 042" -> app would not start.
  Guard added: testBuildOutputHasNoDuplicateMigrationVersions scans build output
  (src is clean, so only this catches it).
- D-23B-B (High): non-UUID path variable reached the DB -> 500 + leaked
  `invalid input syntax for type uuid`. Now rejected at the controller.
- D-23B-C (High): 6 E2E files raised KeyError at import -> never collected.
- D-23B-E (Critical): permissions = 48, role_permissions for super_admin = 18,
  matchmaker = 0. V015's "grant all to super_admin" was a point-in-time snapshot;
  the 30 permissions added later were never granted. On a fresh stack an admin
  cannot create a service station and matchmakers can do nothing. V044 restores
  super_admin to its documented definition (not an expansion); the matchmaker
  permission set needs a product decision and is left as a residual.
- D-23B-I (Medium): IllegalArgumentException (e.g. invalid activity type) was
  unmapped -> 500. Now BAD_REQUEST.
- D-23B-J (High): `operator does not exist: uuid = character varying` — Java
  ids are String, columns are uuid, PostgreSQL does not implicitly cast in
  comparisons. Fixed at the source with JDBC `stringtype=unspecified` (docker
  profile); production datasource comes from deploy env and needs the same.

One judgement retracted: an initial read suggested service_appointment.register
was missing. It is not — the endpoint uses service.assisted_registration, seeded
in V029, and the code deliberately avoids a duplicate permission. Nothing was
changed on that basis.

Verification: 33 E2E passed against a live stack; unreachable stack and a
missing operator password both exit 4 (never skip/pass); backend regression
656 / 0 failures / 0 errors / 3 skipped (baseline 655, +1 guard, negatively
validated by injecting a duplicate V042 -> exactly one test turned red).

tests/e2e/local_eligibility_test.py

@@ -1,39 +1,54 @@
 """
-V1.1 本地资格 E2E —— 空壳已移除（Phase 23 KEEP-VERIFY，2026-09-18）
+本地资格 E2E（INV-011：本地资格佐证不得被未授权方读取）。
 
-历史问题
---------
-原文件 11 个测试函数**全部**为 `pass` 空壳（注释均为「TODO: P04/P05/P06 实现后完善」），
-且依赖 `api_client` / `verified_user` / `local_eligibility_factory` 等
-**在本仓库中根本不存在**的 pytest fixture（全局无 `conftest.py`）。
-这些用例从未执行过，却在 `docs/STATUS.md` 中被计为 P23-T05「本地资格 E2E ✅」。
-
-计划 Phase 23 Gate：「**不允许 skip/pass 空壳**」。
-
-当前状态
---------
-本文件现**不含任何测试函数**，pytest 将收集到 0 个用例 ——
-以「没有假覆盖」取代「假装有覆盖」。
-
-仍待真实实现的场景（需求不因移除空壳而丢失）
-------------------------------------------
-1. 用户可声明丹阳工作 / 户籍 / 居住
-2. 声明本地资格不默认要求上传佐证
-3. 佐证文件上传需要鉴权
-4. 审核员可访问本地资格佐证（INV-011）
-5. 红娘不可访问本地资格佐证（INV-011）
-6. `/me/status` 返回 localEligibilityStatus
-7. 本地资格未核验影响匹配资格
-8. 本地资格审核进入 `review_type=local_eligibility` 队列
-9. 审核通过更新 local_eligibility 状态
-10. 需补充佐证时触发用户上传
-11. 查看佐证文件须记录审计日志
-
-现状补充（Phase 23 实测）
-------------------------
-`LocalEligibilityService` 全部方法均以 `userId` 自限定、**无任何 role 分支**，
-佐证无独立的服务端读取入口（仅经受权限控制的审核队列 `ReviewController` 访问），
-故 INV-011 在结构上成立；但缺少显式守卫测试，列为遗留待补。
-
-真实可执行的 V1.1 E2E 见：`tests/e2e/run_v11_tests.py`
+打真实活栈：新用户经 mock 微信登录，走真实的声明/查询链路。
 """
+import pytest
+
+pytestmark = pytest.mark.e2e
+
+# 生产 local_eligibility 的 eligibility_type CHECK 白名单内的合规取值。
+ELIGIBILITY_TYPE = "household_registration"
+REGION_CODE = "321181"  # 丹阳
+
+
+def test_new_user_is_not_declared(api, user_token):
+    data = api.ok("GET", "/local-eligibility", token=user_token)
+    assert data["verificationStatus"] == "not_declared", f"新用户初始状态异常：{data}"
+
+
+def test_declaration_is_persisted(api, user_token):
+    """声明后应能查回声明内容（真实落库，不是内存态）。"""
+    api.ok(
+        "POST",
+        "/local-eligibility/declaration",
+        token=user_token,
+        json={"eligibilityType": ELIGIBILITY_TYPE, "regionCode": REGION_CODE},
+    )
+    data = api.ok("GET", "/local-eligibility", token=user_token)
+    assert data["eligibilityType"] == ELIGIBILITY_TYPE, f"声明未落库：{data}"
+    assert data["verificationStatus"] != "not_declared", f"声明后状态未推进：{data}"
+
+
+def test_other_user_cannot_read_my_declaration(api, new_user):
+    """
+    INV-011（数据侧）：资格查询是 userId 自限定的，
+    另一个用户读到的必须是**他自己的**空状态，绝不能看到 A 的声明。
+    """
+    user_a = new_user()
+    api.ok(
+        "POST",
+        "/local-eligibility/declaration",
+        token=user_a["token"],
+        json={"eligibilityType": ELIGIBILITY_TYPE, "regionCode": REGION_CODE},
+    )
+    mine = api.ok("GET", "/local-eligibility", token=user_a["token"])
+    assert mine["eligibilityType"] == ELIGIBILITY_TYPE
+
+    user_b = new_user()
+    other = api.ok("GET", "/local-eligibility", token=user_b["token"])
+
+    assert other["userId"] == user_b["user_id"], "返回了他人 userId（越权）"
+    assert other["userId"] != user_a["user_id"]
+    assert other["eligibilityType"] is None, f"B 看到了 A 的资格声明（越权）：{other}"
+    assert other["verificationStatus"] == "not_declared"