TASK METADATA

Target Files: server/main.test.ts, server/tests/forward_auth.test.ts, server/tests/rpc.test.ts, server/tests/auth.test.ts, server/tests/events.test.ts, server/tests/scopes.test.ts
Core Objective: Phase 5 (Test Suite Tier Separation): Decompose the 1,577-line server/main.test.ts monolith into isolated, domain-specific test suites under server/tests/ preserving 100% test coverage and hermetic execution without live database daemons.
Dependencies: tasks/new/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.md
Additional Important Notes: Must run with deno test --allow-all and maintain all 59+ test steps passing cleanly.

Risks:
- Mock state pollution across test files (e.g. shared sqlWrapper or valkey stubs leaking between test cases).
Alternatives:
- Keeping all tests in server/main.test.ts; rejected because single massive test files make targeted debugging and CI test parallelization difficult.

Create Domain Test Files (server/tests/):
- server/tests/forward_auth.test.ts: Tier 1 & 2 ForwardAuth tests, cookie domain scoping, bypass rules, and guest sandbox tests.
- server/tests/rpc.test.ts: Tier 3 ConnectRPC session validation, RBAC grant evaluation, and SPIFFE attestation tests.
- server/tests/auth.test.ts: WebAuthn registration/login PRF extraction, session creation, and audit logging.
- server/tests/events.test.ts: Multi-claim event passes, PIN join endpoints, session extension, and master killswitch.
- server/tests/scopes.test.ts: Zero-trust scope guards, self-revocation, and UI /admin redirection gates.
Quality Gates & Validation:
- Run deno test --allow-all to ensure all domain test suites execute hermetically and pass with 0 failures.