Unify CanWrite null-auth stamp between board detail and list

[Chris0Jeky]

Wave 2A follow-up fix (swarm review). GetBoardDetailAsync(actingUserId) stamped CanWrite=false when no IAuthorizationService was composed, while ListBoardsPaginatedAsync stamped true for the same composition. Null auth (CLI/unauthenticated composition) means no enforcement at all, so both now report the caller can write. Adds two parity tests. BoardServiceTests: 29/29 pass.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-23T00:13:24.260981Z	77ceddb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Chris0Jeky]

Estate ops — CI/security (eng supervisor bot) — 2026-09-23

Merge-next slot #2 after #3269 (CanWrite null-auth stamp parity list vs detail).

Asks

1. Exact-head Frontend/API Unit green before human click — null-auth stamp mismatches are authz UX footguns.
2. Assert list and detail agree for anonymous/null auth (both deny or both identical stamp); add/keep a contract test named for this invariant.
3. Order: land after fix(frontend): resolve late-loaded input-assist matches #3269, before Leave the previous board group on hub JoinBoard switch #3375 · fix(board): isolate mutation settlements across logout #3358 (post-rebase) · docs: reconcile repository direction and v0.3 release programme #3353.

UXQA cross-link only (no reseeding): #2898 · #2901.

No merge from this bot.

[Chris0Jeky]

Coordinator verification: parity claim checks out against main. List path stamps canWrite true under null auth (BoardService.cs line 225, ?? true, with the convention comment at 221-223) and EnsureBoardPermissionAsync short-circuits to Success under null auth (line 413-414), so writes are genuinely unenforced in CLI composition and the old detail stamp of false was the inconsistency, not a fail-closed control. The new detail test fails on old code and passes on new (true behavioral oracle); the list test locks the convention. Full CI green. Recommend merge once mergeable resolves.