test(e2e): run authenticated FastAPI contract lane in hosted CI instead of service-wide skip #1057

Finding

Hosted repository Tests can report GREEN while the real authenticated FastAPI contract suite is entirely skipped. backend/tests/test_api.py is module-level guarded by reachable PostgreSQL + Keycloak + Valkey. The original canary on #1055 exact 08a08108a87657ad427a6b6fa9b1b327166b0c9e passed hosted Tests (1776 passed, 147 skipped, 1 warning) while an authenticated Customer Master response expectation was stale because the entire service-backed API module did not execute.

#1055 has now repaired that specific response-contract drift on exact 831fc52a1969f2999109da2c061067a9dc0ae954: it added an ordinary-hosted serializer contract and updated the real authenticated expectation. That closes the leaf response-shape RED but does not close this topology issue. The hosted suite can still skip bearer/JWKS/RBAC/ABAC behavior wholesale when PostgreSQL/Keycloak/Valkey are unavailable.

This issue owns making authenticated HTTP/PostgreSQL/identity execution required in hosted validation after #1055 settles. It must not reopen or duplicate the Customer Master source lane.

Existing supported fixture

Protected docker-compose.yml already defines the intended development/test topology with bounded health dependencies:

• PostgreSQL on host port 15432 with pg_isready healthcheck;
• replay/migration service waiting for PostgreSQL health;
• Valkey 8 on 16379 with valkey-cli ping healthcheck;
• repository-built Keycloak on 18080 with imported demo realm and the product PostgreSQL as its database;
• backend configuration documents Keycloak as local development mode while production may point at Keyverse/OIDC, so this does not create a second production identity authority.

Hosted CI should consume this repository-owned fixture, or a deliberately smaller profile derived from the same images/config/realm. Do not invent a second auth schema or duplicate Keyverse.

Required architecture and acceptance

Add a bounded hosted E2E lane that starts the minimum supported compose services, waits on explicit readiness, then runs backend/tests/test_api.py or a split equivalent preserving the same real bearer/JWKS/RBAC/ABAC behavior. Required service startup/migration/realm failure must fail the lane rather than degrading to collection-wide skips or continue-on-error.

Acceptance:

• realistic RED proves the ordinary hosted lane can still pass while a deliberately broken authenticated API contract is skipped;
• hosted E2E provisions PostgreSQL + local Keycloak development fixture + Valkey with bounded readiness/cleanup and executes real bearer/JWKS/RBAC/ABAC contracts;
• response-shape, cross-tenant scope, permission and ownership regressions fail hosted CI;
• required service startup/migration/realm failures fail closed rather than turning the module into skips;
• test database/realm/cache lifecycle leaves no cross-run state and uses no privileged long-lived production credential;
• optional external capability tests may keep explicit skips, but core PostgreSQL + identity + Valkey are required for this lane;
• PostgreSQL transaction/deprecation warnings remain visible and are repaired by existing owners test(postgres): align person projection migration fixture with explicit transaction ownership #1038/fix(test): isolate projection migrations from seed transaction #1040 and observability: remove deprecated OpenTelemetry SDK LoggingHandler #1036/fix(telemetry): use supported OpenTelemetry logging handler #973, not filtered here;
• document local/hosted parity in TEST_STRATEGY/OPERABILITY and consume canonical .github reusable infrastructure only where a released owner contract exists;
• exact-head repository, hosted authenticated E2E, Security/SAST/CodeQL and qualifying independent review are GREEN before normal integration.

Do not open a competing source writer while #1055 remains active. After #1055 settles, implement this as a separate test-infrastructure lane and non-force converge onto the then-protected base. No warning suppression, mock-only substitution, continue-on-error, self-approval, no-op validation churn, lifecycle flip loop or gate weakening.