feat(t215): add admin order authorization

backend-api/internal/transport/httpapi/device_handlers_test.go

@@ -629,6 +629,24 @@ func TestDeviceExecutionResultsAreIdempotentAndAuditable(t *testing.T) {
 	if !strings.Contains(candidateReplay.Body.String(), `"replayed":true`) {
 		t.Fatalf("candidate replay response = %s", candidateReplay.Body.String())
 	}
+	detail, err = fixture.tasks.Get(context.Background(), "local-admin", taskID)
+	if err != nil {
+		t.Fatalf("get task after candidate upload: %v", err)
+	}
+	readyEvents := 0
+	for _, event := range detail.Events {
+		if event.Type == "CANDIDATES_READY" {
+			readyEvents++
+		}
+	}
+	if detail.Task.Status != domain.TaskStatusWaitingConfirmation ||
+		readyEvents != 1 {
+		t.Fatalf(
+			"candidate upload status/events = %s/%+v",
+			detail.Task.Status,
+			detail.Events,
+		)
+	}
 
 	humanReviewPayload := fmt.Sprintf(
 		`{"execution_id":%q,"claim_generation":%d,"task_content_sha256":%q,"reason_schema_version":1,"outcome":"CANDIDATE_ACCEPTED","selected_candidate_ordinal":1,"primary_reason_code":"SELECTED_BEST_MATCH","note":"","items":[{"candidate_ordinal":1,"label":"ACCEPT","primary_reason_code":"SKU_MATCH","reason_codes":["SKU_MATCH"],"note":""}]}`,
@@ -696,7 +714,7 @@ func TestDeviceExecutionResultsAreIdempotentAndAuditable(t *testing.T) {
 		t.Fatalf("migration.New() after review error = %v", err)
 	}
 	if err := runner.Down(context.Background()); err == nil {
-		t.Fatal("candidate identity migration down succeeded with retained data")
+		t.Fatal("order workflow migration down succeeded with retained data")
 	}
 
 	completePayload := fmt.Sprintf(