Dave 3d8bc12ed8 test(intake): public route invariants and bad-token 404s ... Phase 8a Task 17. Mirrors the existing intake-submit.test.ts pattern: - happy path: card lands in inbox with created_by_role=anonymous - counter bump: submission_count and last_submission_at update - hostile brief: server-set fields cannot be overridden, even when the body includes top-level priority/accepted/column/created_by - none of unknown/revoked/expired/malformed tokens reach the handler — they all 404 with the same wording - deleted-project token: link cascades away, 404 follows - activity log: card_submitted_anonymously row written		2026-09-21 06:20:06 +02:00
..
integration	test(intake): public route invariants and bad-token 404s	2026-09-21 06:20:06 +02:00