Dave 5fd1b413c3 test(intake): public route invariants and bad-token 404s ... Phase 8a Task 17. Mirrors the existing intake-submit.test.ts pattern: - happy path: card lands in inbox with created_by_role=anonymous - counter bump: submission_count and last_submission_at update - hostile brief: server-set fields cannot be overridden, even when the body includes top-level priority/accepted/column/created_by - none of unknown/revoked/expired/malformed tokens reach the handler — they all 404 with the same wording - deleted-project token: link cascades away, 404 follows - activity log: card_submitted_anonymously row written Deviation from plan: the second project needs an explicit Inbox column created in beforeAll — the schema does not auto-create one for new projects.		2026-09-21 06:30:49 +02:00
..
integration	test(intake): public route invariants and bad-token 404s	2026-09-21 06:30:49 +02:00