[AZ-458] [AZ-467] [AZ-468] [AZ-482] Batch 3 - SSE/RBAC/Header/security tests

Implements 4 blackbox-test tasks for AZ-455 Phase A baseline:

- AZ-458 SSE lifecycle + bearer rotation: 9 fast tests (8 pass, 1
  QUARANTINE for annotation-status); 4 e2e scenarios (gated by suite
  stack). Uses tests/helpers/sse-mock.ts with globalThis.EventSource
  monkey-patch per AC-3 (no stub of src/api/sse.ts). AC-2 bearer
  rotation captured as documented drift via it.fails() — FlightsPage
  useEffect deps do not include the token today.

- AZ-467 ProtectedRoute spinner + timeout + RBAC: 9 new fast tests
  extending the AZ-457 file (6 pass, 3 QUARANTINE), plus 3 e2e
  scenarios. FT-P-32 spinner a11y is it.fails() drift; FT-P-33 timeout
  and FT-N-03/05 RBAC redirects are it.skip QUARANTINE (no production
  behavior today). Positive control: admin_carol reaches /admin.

- AZ-468 Header flight-dropdown a11y: 6 fast tests (5 pass, 1
  QUARANTINE). FT-P-30/31 are it.fails() drift (aria-expanded /
  role=listbox / aria-activedescendant currently missing); FT-N-09
  is it.skip QUARANTINE (no document keydown handler exists).

- AZ-482 Secrets + banned-libs + AC-N1 anti-criterion: 3 new static
  checks (STC-SEC13 legacy integrations, STC-SEC14 concurrent-edit,
  STC-SEC1B dist/ OWM key) plus refactor of 4 existing checks
  (STC-N2/N4/S13/S6) to read from tests/security/banned-deps.json
  via scripts/check-banned-deps.mjs per AZ-482 constraint
  ("deny-list lives in tests/security/banned-deps.json so additions
  are visible in code review"). All 22 static checks PASS.

Totals: 57 fast tests pass + 9 skipped; 22/22 static checks pass.
Self-review verdict PASS_WITH_WARNINGS — all five findings are
documented drifts captured by it.fails() / it.skip QUARANTINE +
control tests. See _docs/03_implementation/batch_03_report.md
for the per-task / per-AC matrix and recommended Phase B follow-up
production tasks (Header a11y; ProtectedRoute spinner/timeout/RBAC;
SSE bearer-rotation reconnect; AnnotationsPage SSE).

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/run-tests.sh

@@ -166,44 +166,40 @@ if [ "$RUN_STATIC" = "true" ]; then
     '
   }
 
+  # AZ-482 — package.json deny-lists routed through the shared
+  # banned-deps.json source-of-truth. Each kind maps 1:1 to a JSON section.
   static_check_no_ml_libs() {
-    node -e '
-      const p = require("./package.json");
-      const all = Object.assign({}, p.dependencies || {}, p.devDependencies || {});
-      const re = /(onnxruntime|tensorflow|tflite|coreml|tfjs|@tensorflow\/|@huggingface\/|transformers\.js)/i;
-      const hits = Object.keys(all).filter(n => re.test(n));
-      if (hits.length) { console.error("banned ML deps:", hits.join(", ")); process.exit(1); }
-    '
+    node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=ml_libs
   }
 
   static_check_no_signature_libs() {
-    node -e '
-      const p = require("./package.json");
-      const all = Object.assign({}, p.dependencies || {}, p.devDependencies || {});
-      const re = /(jsrsasign|tweetnacl|@noble\/|^jose$)/i;
-      const hits = Object.keys(all).filter(n => re.test(n));
-      if (hits.length) { console.error("signature libs:", hits.join(", ")); process.exit(1); }
-    '
+    node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=signature_libs
   }
 
   static_check_no_persistence_libs() {
-    node -e '
-      const p = require("./package.json");
-      const all = Object.assign({}, p.dependencies || {}, p.devDependencies || {});
-      const re = /^(localforage|idb|dexie)$/i;
-      const hits = Object.keys(all).filter(n => re.test(n));
-      if (hits.length) { console.error("persistence libs:", hits.join(", ")); process.exit(1); }
-    '
+    node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=persistence_libs
   }
 
   static_check_no_ws_graphql() {
-    node -e '
-      const p = require("./package.json");
-      const all = Object.assign({}, p.dependencies || {}, p.devDependencies || {});
-      const re = /^(ws|socket\.io|graphql|apollo|@apollo\/|grpc-web|react-dom\/server)$/i;
-      const hits = Object.keys(all).filter(n => re.test(n));
-      if (hits.length) { console.error("banned deps:", hits.join(", ")); process.exit(1); }
-    '
+    node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=ws_graphql_ssr_libs
+  }
+
+  # AZ-482 — NFT-SEC-13 dropped legacy integrations and NFT-SEC-14 AC-N1
+  # anti-criterion. Source-tree scans gated on production code only (the
+  # banned-deps script applies the same `*.test.{ts,tsx}` exclusion src_grep
+  # uses below; tests are allowed to mention these tokens as documentation).
+  static_check_no_legacy_integrations() {
+    node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=legacy_integrations
+  }
+
+  static_check_no_concurrent_edit() {
+    node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=concurrent_edit_patterns
+  }
+
+  # AZ-482 — NFT-SEC-09 AC-1 dist/ portion. The src/ counterpart is STC-SEC1
+  # below; this check runs AFTER `bun run build` (STC-B1) so dist/ exists.
+  static_check_no_owm_key_in_dist() {
+    node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=owm_key_in_dist
   }
 
   # Source-tree text search. Prefer ripgrep when available (much faster on
@@ -378,9 +374,12 @@ if [ "$RUN_STATIC" = "true" ]; then
   run_static "STC-FP22" "i18n key parity en vs ua"       "AC-12"  "45"   static_check_i18n_parity
   run_static "STC-FP23" "no raw user strings outside t()"   "AC-12"  "46"   static_check_i18n_coverage
   run_static "STC-CI11" "CI image tag + OCI labels (woodpecker)" "AC-32" "70" static_check_ci_image_labels
+  run_static "STC-SEC13" "no legacy integrations in src/" "SEC-13" "n/a"  static_check_no_legacy_integrations
+  run_static "STC-SEC14" "no concurrent-edit reconcile (AC-N1)" "SEC-14" "n/a"  static_check_no_concurrent_edit
   run_static "STC-T1"  "tsc --noEmit (test config)"     "AC-6"   "n/a"  static_check_typecheck
   run_static "STC-B1"  "vite build succeeds"            "AC-6"   "n/a"  static_check_vite_build
   run_static "STC-S5"  "mission-planner not in dist/"   "AC-31"  "n/a"  static_check_dist_no_mission_planner
+  run_static "STC-SEC1B" "no literal OWM key in dist/"   "SEC-09" "63"   static_check_no_owm_key_in_dist
 
   if [ "$STATIC_FAIL" = "1" ]; then
     echo "[run-tests] static profile FAILED — see $STATIC_REPORT"