test: cover GET→UPDATE workflow round-trips and n8n API quirks (#433)

[Pitchfork-and-Torch]

Summary

Closes #433 — improves test coverage for the real-world GET → spread → UPDATE pattern that allowed Issue #431 (description / read-only fields on PUT) to ship without a red CI signal.

Problem

Existing update tests cherry-pick writable fields:

await updateWorkflow(id, {
  name: current.name,
  nodes: current.nodes,
  connections: current.connections,
});

Agents and scripts more often do:

const wf = await getWorkflow(id);
await updateWorkflow(id, { ...wf, name: 'New' });

n8n’s Public API is asymmetric (GET returns fields PUT rejects). Without round-trip coverage, cleaning regressions can pass unit cherry-picks and still break production updates.

Changes

Unit (tests/unit/services/n8n-validation.test.ts) — always run in CI

• Clean a full GET-shaped payload (id, description, versionCounter, nodeGroups, tags, …)
• Minimal payload → settings default { executionOrder: 'v1' }
• Empty settings: {} → same default
• Only unknown settings keys → default after filter

Integration (tests/integration/n8n-api/workflows/update-workflow.test.ts) — live n8n when secrets present

Suite	Cases
GET-UPDATE Round Trip	straight GET→UPDATE, spread rename, nested settings spread
n8n API Constraints	description strip (#431), missing settings auto-default, forced read-only echo
Minimal Updates	required fields only; rename + graph
Edge Cases	unknown-only settings; preserve valid + drop unknown

Uses N8nApiClient.updateWorkflow() (runs cleanWorkflowForUpdate) against a real instance — the path users hit.

Docs

• tests/integration/n8n-api/README.md — n8n read/write quirks table + how to run unit vs live suites

Acceptance criteria (#433)

• GET-UPDATE round-trip tests (3)
• n8n API constraint tests (3)
• Minimal payload tests (2)
• Edge case tests (2)
• Unit coverage always in CI (no live n8n required)
• API quirks documented in test comments + README

Test plan

• npx vitest run tests/unit/services/n8n-validation.test.ts --coverage.enabled=false → 112 passed
• Live suite (maintainer CI with N8N_API_* secrets): npm run test:integration:n8n -- tests/integration/n8n-api/workflows/update-workflow.test.ts

Notes

• Edge-case examples in the original issue used callerPolicy as “filtered”; that key is now whitelisted (n8n 1.119+). Tests use truly unknown settings keys instead.
• Issue was previously claimed with no PR; this implements the agreed coverage.