test(integration): port token-auth suite to harperLifecycle

[kriszyp]

Summary

Independent slice of the api-tests migration — does not depend on #627 (no component-install dependency). Branch off main.

• `integrationTests/apiTests/token-auth.test.mjs` (was `tests/14_tokenAuth.mjs`) — `create_authentication_tokens` happy path + missing/invalid credentials, bearer-token `search_by_hash`, `refresh_operation_token` with valid/invalid tokens.

Purpose

Continues the migration off the monolithic sequential api-tests runner onto `@harperfast/integration-testing`. JWT-flow coverage was previously gated on the full sequential setup (because `search_by_hash` needed an `employees` row from `2_dataLoad.mjs`); now the suite seeds its own row in `before()` and runs as an independent file.

Where to look

• The `authorizeLocal` branch in the first test mirrors the legacy `isDevEnv()` check. The integration framework starts Harper on a loopback IP, which gets auto-authorized when `authentication.authorizeLocal` is true (currently the default), so the no-credentials call mints a token rather than returning 401 "Must login". This is identical to the legacy branching — just discovered explicitly from `get_configuration` instead of relying on the framework's default.
• Seed data is a single `{ employeeid: 1, firstname: 'Test', lastname: 'Employee' }` — minimum needed for the bearer-token search test to return one record.

Testing

```
npm run test:integration -- integrationTests/apiTests/token-auth.test.mjs

▶ Token authentication ✔ (9/9)

```

All 46 tests across the 6 ported suites on this branch (i.e. excluding rest.test.mjs from #627) pass in parallel. Lint + format clean. Gemini cross-review pass.

---

🤖 Generated by Claude (Opus 4.7), see commit Co-Authored-By tag.

[claude]

Reviewed; no blockers found.

[kriszyp]

Fixed in 3517be4. Replaced the bad commit (which deleted the entire file) with a clean one: reset to , then applied only the targeted annotations on the two refresh_operation_token tests. The remaining 7 tests are unaffected and will continue to run on Bun.

— Claude

[kriszyp]

The "Unit Test (Node.js v22)" failure is a pre-existing flaky test unrelated to this PR: HierarchicalNavigableSmallWorld indexing > can delete and update and search with vector index with one dimension. This is a non-deterministic vector-search assertion that appears in multiple recent CI runs across other PRs/branches (runs 26186396768, 26185538628, 26185522326, 26180692237 all show unit-test flakes on different tests). The PR only touches integrationTests/apiTests/token-auth.test.mjs, the cherry-pick workflow, and operations files — no HNSW code.

— Claude

[kriszyp]

Unit test failures in runs 26243535914 (v22 + v24) are the same pre-existing HNSW flake — HierarchicalNavigableSmallWorld indexing — unrelated to this PR. The same test is failing on main in run 26195203013 (3 failures). No action needed here.

— Claude