Implement approval engine production readiness

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2

tests/conftest.py

@@ -3,6 +3,7 @@ from datetime import datetime, timezone
 import pytest
 
 from approval_engine.api import App
+from approval_engine.auth import Identity, StaticTokenAuthenticator
 from approval_engine.store import Engine
 
 FROZEN = datetime(2026, 8, 29, 12, 0, tzinfo=timezone.utc)
@@ -22,7 +23,29 @@ def engine(now):
 
 @pytest.fixture
 def app(engine):
-    return App(engine)
+    identity = Identity(
+        subject="agt-secrets-engine",
+        issuer="https://keycape.example",
+        audiences=("approval-engine",),
+        principal_type="service",
+        tenant="platform",
+        roles=frozenset({"secrets-engine"}),
+        scopes=frozenset(
+            {
+                "approval:create",
+                "approval:read",
+                "approval:approve",
+                "approval:revoke",
+                "approval:supersede",
+                "approval:consume",
+                "approval:observe",
+                "approval:emit",
+            }
+        ),
+        assurance={"level": "aal1", "methods": ["test"], "source": "test"},
+        evidence_ref="test-identity:test-token",
+    )
+    return App(engine, StaticTokenAuthenticator({"test-token": identity}))
 
 
 def binding(**overrides):