Third coverage batch — the pure/near-pure cores of the auth layer:
- AuthorizationTest: hasResellerPermissions() flag lookup; check() short-circuit
when identity globals are absent; the 'user'/'line' report-tree scoping via a
real SQLite query (owner/member within self + all_reports); and the 'adv'
permission logic (admin required, super-admin group 1 bypasses the advanced
list, other groups gated by it).
- BruteforceGuardTest: truncateAttempts() drops entries older than the window in
both indexed (reindexed) and associative (keys preserved) shapes; all-recent
and empty inputs. The IO-bound check* methods are left for integration tests.
+12 tests. Suite: 646 tests, 0 errors.
