test: lock polls, check-ins, and discussions tenancy

[cursor]

Summary

After #44/#45, Hub route tests still skipped pulse polls, check-in answers, and discussion posts — those mutating paths only had the static require*Session marker scan. This run locks those Officer Hub surfaces so a tenancy, Zod, or anonymous-submit regression cannot ship unnoticed.

PR #57 (expense/elections/documents list-create) is still open and is not duplicated here. Recent land-acknowledgement PDF and /build/review changes already ship with tests.

Risky behavior now covered

• Polls: list never leaks another union or local; create rejects forged tenant keys and stamps session union/local/creator; duplicate slug 409; GET/PATCH/export 404 another union (including platform_admin) with no write; public submit treats missing and closed polls as 404; consent and invalid options 400; success returns responseId only (no IP); hashed IP is stored, not the raw address; 429 after eight submits from the same forwarded IP.
• Check-ins: list never leaks another union or local; steward cannot create a schedule; create rejects tenant keys and stamps the session; overlay tenant without the module is 403; answers GET/POST 404 another union; steward can answer the current daily period once then 409; wrong period and inactive schedule 400.
• Discussions: list never leaks another union or local; create rejects tenant keys and stamps the session; grievance+bumping link 400; overlay without the module is 403; posts/reactions 403 another union with no write; steward can post and toggle a reaction; extra reaction keys 400; post/thread mismatch 404.

Test files added/updated

• src/lib/polls/api-routes.test.ts
• src/lib/polls/rate-limit.test.ts
• src/lib/validation/polls.test.ts
• src/lib/checkins/api-routes.test.ts
• src/lib/checkins/memory-adapter.ts (test reset helper only)
• src/lib/discussions/api-routes.test.ts
• src/lib/discussions/memory-adapter.ts (seed restore on reset)

Why this reduces regression risk

These are anonymous member-facing poll submits plus confidential officer check-in and discussion writes. A missed unionId filter, a spread of tenant keys onto create, or a public submit that skipped consent/rate-limit would leak or write across tenants. The new tests exercise the real route handlers (not just access helpers) so session gating, Zod .strict(), and adapter writes stay aligned.

No production behavior changed.

Checklist

• No secrets, .env, keys, or real member/PII data
• User-facing strings updated in both messages/en.json and messages/fr.json (if applicable)
• Role/tenancy rules respected (unionId scoping; no cross-union access)
• npm run lint and npm run test:unit pass
• Smoke tests run if UI/routes changed (npm run test:smoke)
• Docs updated if setup/deploy/privacy behaviour changed

Test plan

• npx vitest run src/lib/polls/api-routes.test.ts src/lib/polls/rate-limit.test.ts src/lib/validation/polls.test.ts src/lib/checkins/api-routes.test.ts src/lib/discussions/api-routes.test.ts (31 passed)
• Related suites src/lib/checkins src/lib/discussions src/lib/polls (50 passed)
• npx eslint on the seven touched files (clean)
• Smoke not required (tests only; no UI/route production changes)