Add POST /api/v1/docgov/proposal for ProposeModification, harden decide
status mapping, and replace App pendingProposal local mock with real API calls.
Co-authored-by: Cursor <cursoragent@cursor.com>
Boot memory IAM only via explicit test env opt-in; strict auth cases
disable AllowInMemory after startup.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register newTestServer cleanup and Shutdown WaitIdle so race detector
no longer hits RemoveAll on a live DataDir.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.