no-double-accept, Inbox-never-accepts, and 404s
Adds the whole-branch-review test gaps: a single parametrised test looping
over all 6 (method, path, body) combinations asserting 401 for missing and
wrong tokens plus no-write-occurred for the 3 write routes; a move-route
case-insensitivity assertion (real column name uppercased); a negative test
that moving an already-accepted card again does not re-log card_accepted;
a negative test that moving a card into Inbox never sets accepted: true;
and 404 checks for a nonexistent card id across GET/POST/POST/PATCH.
Each new describe block creates and cleans up its own dedicated fixture
card(s), since the existing cardId fixtures from earlier describes in this
file are already deleted by their own afterAll by the time these run.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
