fix(plugin-auth): repoint stale last-admin-ban-guard.ts citations (#16575)

Five source comments in packages/plugins/plugin-auth/src/ cited
last-admin-ban-guard.ts / last-admin-ban-guard.test.ts, filenames that
have not existed since the guard was renamed to last-admin-guard.ts.
Repoint the four straightforward rename citations, and — after reading
the test before repointing it, per the non-mechanical instruction on
this card — repoint the objectql-adapter.test.ts:456 citation to
last-admin-guard.test.ts, which is where the 403 arm (PERMISSION_DENIED
-> APIError statusCode 403, via createObjectQLAdapterFactory) is
actually pinned; last-admin-guard.re-pricing.test.ts and
.config-anchor.test.ts contain no matching assertion.

No behaviour change. CHANGELOG.md's historical hits are untouched.


Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-trump

packages/plugins/plugin-auth/src/break-glass-local-credential.test.ts

@@ -5,7 +5,7 @@
  * invariant — pinned, not implemented.
  *
  * #5892 asked for two things. The ban half was missing and is built in
- * `last-admin-ban-guard.ts`; this half — "`enforced` SSO must never disable the
+ * `last-admin-guard.ts`; this half — "`enforced` SSO must never disable the
  * last local admin's password" — was **already implemented** on `origin/main`
  * and had no test of its own, which is the state that lets a security
  * behaviour be refactored away without anything going red. So this file adds
@@ -287,7 +287,7 @@ describe('[#5892] the last local password login survives ban / remove / delete',
     };
 
     // A blocked legitimate removal is the cost here; a locked-out environment
-    // is the cost in `last-admin-ban-guard.ts`. Different failure modes,
+    // is the cost in `last-admin-guard.ts`. Different failure modes,
     // different directions — see that file's header.
     await expect(
       config.hooks!.before!(hookCtx('/admin/ban-user', { userId: 'usr_owner' }, adapter)),

packages/plugins/plugin-auth/src/invitation-role-cap.ts

@@ -98,7 +98,7 @@ export function orgRoleGrade(raw: unknown): number {
  * a hand-written copy drops the comma-joined (`'owner,member'`) and array
  * spellings `parseOrgRoles` handles, and on a security path that difference is
  * silent. Second consumer, and the reason this is exported: the break-glass
- * ban guard (`last-admin-ban-guard.ts`, cloud ADR-0024 D5.2), which counts the
+ * ban guard (`last-admin-guard.ts`, cloud ADR-0024 D5.2), which counts the
  * administrators an environment would have left after a ban — a guard that
  * mistook the only owner for an ordinary member would wave the lockout
  * through.

packages/plugins/plugin-auth/src/objectql-adapter.test.ts

@@ -453,7 +453,7 @@ describe('withValidationErrorMapping – ObjectQL ValidationError → better-aut
 
   // "Unclassified" — an error carrying neither the validation envelope nor the
   // `PERMISSION_DENIED` policy-refusal code the break-glass guards throw
-  // (ADR-0024 D5.2; the 403 arm is pinned in `last-admin-ban-guard.test.ts`).
+  // (ADR-0024 D5.2; the 403 arm is pinned in `last-admin-guard.test.ts`).
   // A driver fault is exactly that, and it must NOT be dressed up as a 4xx.
   it('re-throws unclassified errors verbatim (not remapped to an APIError)', async () => {
     const boom = new Error('driver exploded');

packages/plugins/plugin-auth/src/objectql-adapter.ts

@@ -534,7 +534,7 @@ function isObjectQLValidationError(
  * the guards live in this package but throw a plain engine-shaped error so that
  * BOTH transports can map it — `mapDataError` gives the REST data routes a 403,
  * this gives the auth pipeline one. The concrete case is the break-glass
- * last-administrator ban guard (ADR-0024 D5.2, `last-admin-ban-guard.ts`):
+ * last-administrator ban guard (ADR-0024 D5.2, `last-admin-guard.ts`):
  * without this arm, an over-broad SCIM deprovision would be refused correctly
  * and then reported to the IdP as an opaque 500, which is the one thing a guard
  * whose whole product is an explanation must not do.