feat(16.3-03): journal scopes and ResolveBackend token auth

- Register journal and journal:read via pact.HasTokenScopes
- Switch API auth to cabana.ResolveBackend with golem15.journal.* cover
- Map ErrTokenScope to PHP Insufficient permissions bodies
- Add TestResolveErrorMapping and TestJournalTokenTracer

Co-authored-by: Cursor <cursoragent@cursor.com>

controllers/api/auth_test.go

@@ -0,0 +1,70 @@
+package api
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/cabana"
+)
+
+func TestResolveErrorMapping(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name   string
+		err    error
+		status int
+		body   string
+	}{
+		{
+			name:   "ErrTokenScope",
+			err:    cabana.ErrTokenScope,
+			status: http.StatusForbidden,
+			body:   `{"error":"Insufficient permissions"}`,
+		},
+		{
+			name:   "wrapped ErrTokenScope",
+			err:    fmt.Errorf("cover: %w", cabana.ErrTokenScope),
+			status: http.StatusForbidden,
+			body:   `{"error":"Insufficient permissions"}`,
+		},
+		{
+			name:   "ErrUnauthenticated",
+			err:    cabana.ErrUnauthenticated,
+			status: http.StatusUnauthorized,
+			body:   `{"error":"Authentication required"}`,
+		},
+		{
+			name:   "generic error",
+			err:    errors.New("boom"),
+			status: http.StatusUnauthorized,
+			body:   `{"error":"Authentication required"}`,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			resolveError(rec, tc.err)
+			if rec.Code != tc.status {
+				t.Fatalf("status = %d, want %d; body=%s", rec.Code, tc.status, rec.Body.String())
+			}
+			got := rec.Body.Bytes()
+			var wantObj, gotObj map[string]any
+			if err := json.Unmarshal([]byte(tc.body), &wantObj); err != nil {
+				t.Fatal(err)
+			}
+			if err := json.Unmarshal(got, &gotObj); err != nil {
+				t.Fatalf("body json: %s err=%v", got, err)
+			}
+			wantRaw, _ := json.Marshal(wantObj)
+			gotRaw, _ := json.Marshal(gotObj)
+			if string(wantRaw) != string(gotRaw) {
+				t.Fatalf("body = %s, want %s", got, tc.body)
+			}
+		})
+	}
+}