Complete flex-auth PEP and document railiance packaging path

Local + HTTP POST /v1/check PEP with fail-closed transport errors;
shell:view enforced on /app/. Vocabulary docs for T07. Helm chart lives
in railiance-apps; Dockerfile already present for T08.

tests/test_flex_auth.py

@@ -0,0 +1,62 @@
+import json
+from unittest.mock import MagicMock, patch
+
+from coulomb_social.apps.identity import flex_auth
+
+
+def test_local_shell_view_allow():
+    d = flex_auth.check("shell:view", resource="shell", subject="s1")
+    assert d.allow is True
+    assert d.effect == "allow"
+
+
+def test_local_member_self_read():
+    ok = flex_auth.check(
+        "member:self:read", resource="member", resource_id="sub-1", subject="sub-1"
+    )
+    assert ok.allow is True
+    bad = flex_auth.check(
+        "member:self:read", resource="member", resource_id="sub-1", subject="other"
+    )
+    assert bad.allow is False
+
+
+def test_local_unknown_deny():
+    d = flex_auth.check("member:admin", resource="member", subject="s1")
+    assert d.allow is False
+
+
+def test_http_allow(settings):
+    settings.FLEX_AUTH_BASE_URL = "http://flex.example"
+    settings.FLEX_AUTH_PROTECTED_SYSTEM_ID = "coulomb-social"
+    settings.DEFAULT_TENANT_ID = "tenant:coulomb"
+    settings.USER_ENGINE_APPLICATION_ID = "coulomb-social"
+
+    body = json.dumps({"id": "dec-1", "effect": "allow", "reason": "policy"}).encode()
+    mock_resp = MagicMock()
+    mock_resp.__enter__.return_value = mock_resp
+    mock_resp.__exit__.return_value = False
+    mock_resp.read.return_value = body
+
+    # json.load on response
+    import coulomb_social.apps.identity.flex_auth as mod
+
+    with patch.object(mod, "urlopen", return_value=mock_resp):
+        with patch.object(mod, "json") as j:
+            j.load.return_value = {"id": "dec-1", "effect": "allow", "reason": "policy"}
+            j.dumps = json.dumps
+            d = flex_auth.check("shell:view", subject="s1", tenant="tenant:coulomb")
+    assert d.allow is True
+    assert d.decision_id == "dec-1"
+
+
+def test_http_fail_closed(settings):
+    settings.FLEX_AUTH_BASE_URL = "http://flex.example"
+    from urllib.error import URLError
+
+    import coulomb_social.apps.identity.flex_auth as mod
+
+    with patch.object(mod, "urlopen", side_effect=URLError("down")):
+        d = flex_auth.check("shell:view", subject="s1")
+    assert d.allow is False
+    assert "fail-closed" in d.reason