test: audit-driven coverage for security-relevant pure logic

+16 tests (432 -> 448): permissions-catalog least-privilege guard
(non-board roles carry no high-risk capability; member/associate are
read-only); new invite-logic suite (exact-match creator role, non-admin
grants nothing, invalid/mis-cased targets); door-logic SSRF host-spoof
edges (userinfo-spoofed host rejected, case-insensitive pin match,
trailing-dot FQDN fails closed) + redactDoorSecrets regex-special
password and end-of-string e= value; classes pickPromotion unlimited-
capacity branch + equal-timestamp tie-break.

__tests__/door-logic.test.ts

@@ -111,4 +111,24 @@ describe('redactDoorSecrets', () => {
   it('leaves unrelated text intact', () => {
     expect(redactDoorSecrets('status 200 ok', null)).toBe('status 200 ok')
   })
+  it('redacts a regex-special password literally (split/join, not regex)', () => {
+    expect(redactDoorSecrets('controller said a.*b ok', 'a.*b')).toBe('controller said <redacted> ok')
+  })
+  it('redacts an e= value with no trailing delimiter (end of string)', () => {
+    expect(redactDoorSecrets('GET /?o1&e=1234')).toBe('GET /?o1&e=<redacted>')
+  })
+})
+
+describe('validateDoorTarget — SSRF host-spoof edges', () => {
+  it('rejects a userinfo-spoofed host (real host is what after @)', () => {
+    // new URL(...).hostname is "evil.com", not the pinned LAN IP -> reject
+    const r = validateDoorTarget('http://[email protected]/?o1', '192.168.1.50')
+    expect(r.ok).toBe(false)
+  })
+  it('matches the pin case-insensitively for hostnames', () => {
+    expect(validateDoorTarget('http://Door.Local/?9', 'door.local').ok).toBe(true)
+  })
+  it('a trailing-dot FQDN does not equal the bare pin (fails closed)', () => {
+    expect(validateDoorTarget('http://door.local./?9', 'door.local').ok).toBe(false)
+  })
 })