test: prove session-authoritative history reads

[Joncallim]

Summary

Adds a mandatory six-role PostgreSQL acceptance proof for the real human Architect plan-history route.

The proof uses the actual password login handler to create a canonical forge_session cookie, then invokes the actual protected-history route and dedicated history reader. It verifies:

• a live PostgreSQL-backed session succeeds while Redis is unavailable;
• the response carries protected entries but no credential or session-storage locator;
• one truthful, text-free history audit is written for the successful read;
• revoked, expiry-boundary, rotated-old, forged-cache/unknown, cross-user task, and wrong-version requests are denied without another audit.

Scope

Test-only change to the existing mandatory S4 PostgreSQL fixture. It preserves production route/session/history behavior and automatically runs through test:mcp:s4-postgres, which already fails closed if any required role URL is absent.

Validation

• npm test — 1,581 passed; 17 environment-gated skips
• focused route/S4 static test — 11 passed, 10 skipped locally for absent PostgreSQL roles
• npx tsc --noEmit
• npm run lint -- --max-warnings=0
• npm run build
• git diff --check

The mandatory S4 command was run locally and correctly failed before executing because no six-role fixture URLs are provisioned. In CI the test is unskipped and covered by the existing zero-skip guard.