test(backend): add integration tests for access group promote/demote (ref #1142)

[wp99cp]

This PR adds integration and functional tests for the access group promote and demote user endpoint, ensuring database updates, validation constraints, and audit log events are properly asserted. See #1142

[greptile-apps]

Greptile Summary

This PR adds integration tests for the promote and demote user endpoints on access groups, covering happy-path DB updates, the "last editor" conflict guard, and authorization for non-editors. It also introduces a pollForAuditEvent helper that retries the audit-log query, addressing the async race condition flagged in earlier review threads.

• Four new tests cover: editor promotes a member, editor demotes an editor, conflict when demoting the last editor, and a non-editor (both member and unrelated user) attempting promote or demote — all returning the expected status codes with DB and audit-log assertions.
• pollForAuditEvent retries up to 10 times with 50 ms intervals to wait for the detached audit-log write to commit, replacing the previous direct query that was prone to timing failures.
• Details key confirmed: the service logs { userUuid, userName, canEditGroup } in the PROMOTE_USER/DEMOTE_USER event, matching promoteEvent.details.userUuid and demoteEvent.details.userUuid used in the assertions.

Confidence Score: 5/5

Test-only change; no production code is modified and the new tests exercise the correct API surface with proper assertions.

All changes are confined to the integration test file. The pollForAuditEvent helper correctly resolves the async audit-log timing issue from earlier reviews, the details.userUuid key matches what the service actually stores, and the non-editor tests now cover both the promote and demote paths for both member and unrelated-user roles.

No files require special attention.

Important Files Changed

Filename	Overview
backend/tests/auth/access-groups/access-groups.test.ts	Adds four integration tests for promote/demote user permissions, pollForAuditEvent helper, and a demote-last-editor conflict guard test; assertions cover HTTP status, response body, DB state, and audit log events.

_{Reviews (2): Last reviewed commit: "test(backend): fix flaky audit log asser..." | Re-trigger Greptile}

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.