Boot memory IAM only via explicit test env opt-in; strict auth cases disable AllowInMemory after startup. Co-authored-by: Cursor <cursoragent@cursor.com>
Add disabled-user 401, admin roles/sessions handler tests, optional PG store integration, cross-project 403 fixture, and update the Phase 1 test report to reflect completion status. Co-authored-by: Cursor <cursoragent@cursor.com>