FLEX-WP-0035 T01-T03: application access readback pin

Contract accepted by user-engine; FLEX-DEC-2026-019 accepted.
- serve-readback: dedicated pin, no enforcement routes, own caller binding
- CheckRequest.purpose hashed into every digest when set; /v1/check refuses it
- POST /v1/readback/application_access and GET /v1/readback/systems
- optional client_binding on protected systems; readback schemas
- schemaguard implements maxItems
- T05 added: informed-decision needs an application.access rule over
  realm-level claims (its lifecycle rules read authentication_audience)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212

pkg/api/purpose_test.go

@@ -0,0 +1,25 @@
+package api
+
+import "testing"
+
+// FLEX-DEC-2026-019: purpose is hashed when set and absent when empty, so an
+// enforcement digest is unchanged and a readback digest can never equal one.
+func TestPurposeEntersDigestsOnlyWhenSet(t *testing.T) {
+	request := CheckRequest{
+		Subject:  SubjectRef{ID: "user:alice"},
+		Action:   "application.access",
+		Resource: ResourceRef{ID: "demo-app", System: "demo-app"},
+	}
+	legacy := CanonicalDigest(requestDigestMaterial{Subject: request.Subject, Action: request.Action, Resource: request.Resource})
+	if RequestDigest(request) != legacy {
+		t.Fatal("an empty purpose changed the enforcement digest")
+	}
+	readback := request
+	readback.Purpose = PurposeReadback
+	if RequestDigest(readback) == RequestDigest(request) || ApprovalBindingDigest(readback) == ApprovalBindingDigest(request) {
+		t.Fatal("purpose did not enter the digests")
+	}
+	if binding := NewDecisionBinding(readback); binding.Purpose != PurposeReadback {
+		t.Fatalf("binding purpose = %q", binding.Purpose)
+	}
+}