test(16.3-04): full Go coverage for tokens, guard, account API and CLI

Pin bouncer Scope serialization, party Activated order, lagoon migration,
compile/overlap/mint/expiry/validation, guard/debounce/resolver,
interactive-only, account token API and CLI on Postgres.

Co-authored-by: Cursor <cursoragent@cursor.com>

modules/bouncer/context_test.go

@@ -1,6 +1,8 @@
 package bouncer
 
 import (
+	"encoding/json"
+	"strings"
 	"testing"
 	"time"
 )
@@ -30,3 +32,28 @@ func TestContextCredentialRoundTrip(t *testing.T) {
 		t.Fatalf("nil ctx got %#v ok=%t", got, ok)
 	}
 }
+
+func TestPrincipalScopeNotSerialized(t *testing.T) {
+	p := Principal{
+		ID:    1,
+		Scope: &ScopeLimit{Full: true, Scopes: [][]string{{"a.b"}}},
+	}
+	raw, err := json.Marshal(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(raw), "Scope") || strings.Contains(string(raw), "scope") || strings.Contains(string(raw), "Full") {
+		t.Fatalf("Scope leaked into JSON: %s", raw)
+	}
+	var decoded map[string]any
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := decoded["Scope"]; ok {
+		t.Fatal("Scope key present")
+	}
+	var zero Principal
+	if zero.Scope != nil {
+		t.Fatal("nil Scope is not the zero value")
+	}
+}