019faf74 - Cover gs/db trigger rejection over HTTP

[TaprootFreak]

What

Follow-up to #4476:

• exercise missing-trigger rejection for both POST /gs/db and POST /gs/db/custom through the real GsController, NestJS routing, ValidationPipe, guards, and HTTP exception mapping
• assert the 400 Trigger type is required response, audit log, and absence of both GS service calls
• positively pin each valid HTTP route to its exclusive service method and distinct response
• replace the wall-clock unit assertion with a deterministic structural check that observes audit logging and service non-entry immediately after invoking each handler, before awaiting its rejection

Why

The first review of #4476 correctly identified that its regression coverage called controller methods directly and used a wall-clock threshold. That proved the controller branch but did not pin the actual HTTP contract, and the timing assertion could be flaky under scheduler load.

This follow-up covers the production controller at the HTTP boundary and tests the synchronous ordering without relying on elapsed wall time.

Deliberate non-change

The review also suggested deleting the persisted gsTriggerEnforcement row. This PR does not do that: the repository's critical auditable-mutation rule forbids destructive deletion when the previous value would no longer be reconstructible from the database. #4476 already removed every runtime read and the schema registration, so the retained row is inert historical data rather than an active control.

Validation

Validated on exact signed commit bc49f57a25cf75876350ec3d96a3916c41e93cc7:

• targeted Jest: 2 suites, 26 tests passed
• format, lint, build, and type-check passed
• four independent Codex review passes; all findings fixed, final conformity and logic reviews: 0 findings
• all GitHub CI, coverage, CodeQL, and review-bot checks passed

Production smoke for merged #4476: 10/10 authenticated missing-trigger requests returned HTTP 400 with Trigger type is required in 58–85 ms.

[TaprootFreak]

Follow-up validation complete on signed commit bc49f57a25cf75876350ec3d96a3916c41e93cc7.

• 4 independent Codex review passes: initial conformity review found 2 low issues, initial logic review found 1 route-mapping blind spot; all fixed. Final conformity and logic re-reviews: 0 findings.
• Real NestJS HTTP coverage now exercises both missing-trigger rejections and positively pins /gs/db vs. /gs/db/custom to their exclusive service methods.
• Build-host validation: 2 suites / 26 tests passed, plus format, lint, build, and type-check.
• GitHub CI, coverage, CodeQL, and review-bot checks are all green.
• The persisted gsTriggerEnforcement row is intentionally retained as inert historical data; deleting it would violate the repository's auditable-mutation/no-data-loss rule.
• Production smoke for merged 019faf74 - Reject slow missing-trigger gs/db requests #4476: 10/10 correct HTTP 400 responses in 58–85 ms.