fix(tests): repair 3 CI failures from the export-entitlement gate (b82e772)

CI has been red since the export-gate batch; all 3 failures trace to
b82e772 and were missed when the test_backend_workspace.py fallout was
fixed:

- resume_builder_export_unknown_session / _400_real_message: the route
  enforces the export entitlement BEFORE hydrating the session
  (ADR-027 — a blocked request must have no side effects). docx /
  classic_ats from an anon (free) caller now correctly returns the
  canonical 429 entitlement response, so these scenarios never reached
  the unknown-session 400 path they exist to verify. Switched the
  payloads to the free-entitled combo (pdf + professional_neutral) so
  the request clears the gate and hits the 400-with-friendly-message
  path. Intent of the tests is preserved; behaviour under test is
  unchanged.
- test_backend_http_exceptions_use_friendly_detail: the audit
  allowlist pins the InvalidFeedbackError str(error) site in
  backend/routers/workspace.py by line number; b82e772 added
  auth/gate branches above it, drifting it 651 -> 686 (the comment
  already documents this exact recurring drift: 617->629->639->650
  ->651). Bumped to 686 per the documented procedure.

Test-only changes; no production code touched. The 2 export
scenarios + the audit pass; surrounding slice green (16 passed).
Full suite couldn't be run to completion locally (network-bound
tests hang offline) but CI deterministically reported exactly these
3 failures / 653 passed, so this should land 656/0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: LEANDERANTONY

tests/test_error_handling_scenarios.py

@@ -106,12 +106,18 @@ def _scenario_resume_builder_message_unknown_session():
 
 
 def _scenario_resume_builder_export_unknown_session():
+    # Must use the free-entitled combo (pdf + professional_neutral):
+    # the route enforces the export entitlement BEFORE hydrating the
+    # session (ADR-027 — a blocked request has no side effects), so
+    # docx / classic_ats from an anon (free) caller now correctly
+    # returns the canonical 429 entitlement response, never reaching
+    # the unknown-session 400 path this scenario exists to verify.
     response = client.post(
         "/api/workspace/resume-builder/export",
         json={
             "session_id": "wrong-id",
-            "export_format": "docx",
-            "theme": "classic_ats",
+            "export_format": "pdf",
+            "theme": "professional_neutral",
         },
     )
     assert response.status_code == 400
@@ -254,12 +260,15 @@ def _scenario_resume_builder_export_returns_400_with_real_message():
     user-typed string (not a leaked exception). Even when the lint
     catches the same shape statically, the runtime sees what the
     actual response body looks like."""
+    # Free-entitled combo so the request clears the export-entitlement
+    # gate (ADR-027, enforced pre-hydrate) and actually reaches the
+    # unknown-session 400 path whose message shape this asserts.
     response = client.post(
         "/api/workspace/resume-builder/export",
         json={
             "session_id": "definitely-not-real",
-            "export_format": "docx",
-            "theme": "classic_ats",
+            "export_format": "pdf",
+            "theme": "professional_neutral",
         },
     )
     assert response.status_code == 400

tests/test_error_messages.py

@@ -223,12 +223,11 @@ def _audit_python_file(path: Path) -> list[dict]:
     # debug a bad payload; there's no internal state in the string.
     # Line drifts each time the feedback / transcribe route grows a
     # new auth-handling branch above this InvalidFeedbackError site.
-    # 617 → 629 → 639 → 650 → 651. Update when CI flags a new line
-    # number. Latest drift: observability commit captured the result
-    # variable instead of returning record_feedback() inline so the
-    # capture_event call could fire AFTER the write succeeds; that
-    # added one line above the InvalidFeedbackError branch.
-    (_os_for_paths.path.join("backend", "routers", "workspace.py"), 651),
+    # 617 → 629 → 639 → 650 → 651 → 686. Update when CI flags a new
+    # line number. Latest drift: the b82e772 export-entitlement commit
+    # added auth/gate branches above the feedback route, pushing the
+    # InvalidFeedbackError `str(error)` site from 651 to 686.
+    (_os_for_paths.path.join("backend", "routers", "workspace.py"), 686),
 }