test(matrix): W4 stacks-advanced block integration suite (move exempt→mapped)

[mastermanas805]

What

Closes the eight /api/v1/stacks/:slug/* stacks-advanced routes that were carried as routeCoverageExemptions in the done-bar guard, moving them exempt→mapped with a real DB-backed integration suite.

Route	Test
POST /api/v1/stacks/:slug/confirm-deletion	TestStacksAdvancedBlock_ConfirmDelete_TokenizedTwoStep
DELETE /api/v1/stacks/:slug/confirm-deletion	TestStacksAdvancedBlock_ConfirmDelete_MissingTokenAndCancel
POST /api/v1/stacks/:slug/promote	TestStacksAdvancedBlock_Promote_ApprovalGateAndAuthz (+ _ContractValidation)
GET /api/v1/stacks/:slug/family	TestStacksAdvancedBlock_Family_HappyAuthzAndCache
POST /api/v1/stacks/:slug/domains	TestStacksAdvancedBlock_Domains_FullLifecycle
GET /api/v1/stacks/:slug/domains	TestStacksAdvancedBlock_Domains_FullLifecycle
POST /api/v1/stacks/:slug/domains/:id/verify	TestStacksAdvancedBlock_Domains_FullLifecycle
DELETE /api/v1/stacks/:slug/domains/:id	TestStacksAdvancedBlock_Domains_TierGateAndCrossTeamRow

How

New internal/handlers/stacks_advanced_block_integration_test.go drives every route through the production auth chain (RequireAuth + the /api/v1 group; newStacksAdvancedApp mirrors router.go) against a real Postgres (testhelpers.SetupTestDB). Reuses existing helpers (requireTestDB, ensureStackTables, mustUUIDStr, MustCreateTeamDB/MustSignSessionJWT, models.CreateStack/CreatePendingDeletion/CreateCustomDomain, the SetLookupTXTForTest seam) — nothing redefined, no handler-source edits.

Real contract per handler (rule 16):

• confirm-deletion is tokenized + two-step: POST ?token CASes a pending_deletions row to confirmed and tears the stack down (single-use → 410 replay; cross-team token → 410); DELETE cancels (session is auth) → cancelled.
• promote validates env (invalid_env/invalid_target/env_mismatch) and short-circuits a non-dev target to 202 pending_approval + a promote_approvals row before any compute.
• family is the Pro-gated env-family read + Cache-Control: private, max-age=60.
• domains create→list→verify(TXT seam advances pending_verification→verified)→delete round-trips + the per-count/feature tier gates from plans.Registry.

Authz axes: owner + member (same team_id) 2xx, non-member cross-team 404 (never 403), unauth 401, off-tier (hobby) 402.

The external DNS / cert-manager ingress+cert legs need a live k8s and are asserted only up to the verified state (k8s nil) — deferred to the W4 custom-domain e2e spec, but the routes are mapped.

PATCH /stacks/:slug/env stays exempt (out of this PR's scope).

Guard state

Both done-bar guards green (TestDoneBar_EveryRouteCovered + TestDoneBar_TestMapPointsAtRealTests). mapped 98→106, exempt 73→65.

Gate

make gate green except the pre-existing non-deterministic TestLinkGitHubID flake in internal/models (untouched package; verified identical on clean origin/master with these files stashed). My packages (internal/handlers, internal/router) pass. CI is authoritative.

🤖 Generated with Claude Code