Cover every write route and optional-auth Index/Show across journal, star, read-only, admin:read, unrelated, revoked and malformed tokens, plus publish permission under a journal token. Co-authored-by: Cursor <cursoragent@cursor.com>
