Draft: test(auth): cover fine-grained Orbit tokens end to end

What does this MR do and why?

This MR adds Robot coverage for fine-grained token access through the Orbit REST and MCP endpoints. The suite uses private fixtures to prove that granted data is visible and denied data stays hidden.

Request flow

1. Rails authenticates the token and sends Orbit a signed JWT with token_authorization_required: true. The JWT contains no raw token or grants.
2. Orbit identifies the required permissions and asks Rails to check them through Workhorse.
3. Workhorse forwards the original credentials to the internal Rails callback.
4. Rails checks the token’s saved grants and returns allow/deny decisions for each permission and resource.
5. Orbit uses those decisions to filter query inputs. Final resource checks also enforce the user’s existing abilities.

Related Issues

• Relates to fine-grained token issue 992.
• Depends on GKG MR !2409.
• Depends on Rails MR !253835.
• Uses the Workhorse stream pattern from GitLab MR !229394.
• Relates to the hidden aggregate-input risk in Orbit issue 347.

Fixture setup

Wait for both parent projects to reach Orbit before creating issues and the test pipeline. This uses the existing indexing budget and avoids temporary invalid paths.

Testing

The live run against the Rails shared service passed all 20 cases: five smoke cases and 15 fine-grained token cases. The full 66-case Robot dry run also passes. Pipeline 2825071747 passes.

Performance Analysis

This MR changes test code only. It does not change an Orbit runtime path.

• This merge request does not introduce any performance regression.

Agent context

The suite creates an isolated user, private graph fixtures, and fine-grained tokens. Cases include gateway-only tokens, tokens without gateway access, and tokens with selected resource or feature grants. The suite reads through REST and MCP, checks allowed and denied results, and removes its fixtures.

This separate Draft depends on the GKG and Rails behavior MRs. It does not add grants or change production authorization.