Lays the groundwork for Tasks 2-10 of the REST API authorization fix plan.
Adds an in-memory SQLite test engine, a TestClient fixture that
short-circuits Memory.from_config() (pgvector is unavailable in tests),
and reusable fixtures for admin/member users, JWTs, the legacy
ADMIN_API_KEY env, and AUTH_DISABLED mode.
Eleven-task TDD plan tracking the spec at
docs/superpowers/specs/2026-05-13-rest-api-authz-fix-design.md
(commit 8f285c75). Adds _ensure_admin helper, six admin-gated routes,
inside-route guard on GET /memories, server/ pytest scaffold (SQLite +
MagicMock), server-ci.yml workflow, and surgical docs edits. Each task
follows red/green/commit TDD; every gate covers the four supported
deployment modes (admin JWT, admin per-user key, ADMIN_API_KEY env,
AUTH_DISABLED).
Adds the design document for the B+ scope fix in response to the
2026-05-01 security report on per-user API key authorization. Spec
covers the require_admin helper, six admin-gated routes, the
inside-route guard on GET /memories, surgical docs edits, and a
minimal test scaffold for server/. owner_id work and multi-user invite
flow are explicitly deferred to a tracked follow-up issue.
Mgeeeek