feat: implement T19, T20 — Scenario B/C replacement tests; complete workplan

- T19: Scenario B tests — IAM swap correctness (7 tests: profile safety, client mapping, user/group preservation)
- T20: Scenario C tests — full expansion correctness (6 tests: LDIF round-trip, target differences, MFA orthogonality)
- CI scripts: test-scenario-b.sh, test-scenario-c.sh
- README: complete documentation with quick start, endpoints, migration guide
- Workplan: all acceptance criteria checked off

All 23 tasks done. 15 test packages, all green. go vet clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/tests/migration/fixtures_test.go

@@ -0,0 +1,86 @@
+package migration_test
+
+import (
+	"time"
+
+	"keycape/internal/domain"
+	"keycape/internal/migration/lldapexport"
+)
+
+// canonicalFixture returns a deterministic ExportResult for use in all migration tests.
+func canonicalFixture() *lldapexport.ExportResult {
+	return &lldapexport.ExportResult{
+		Users: []domain.User{
+			{
+				ID:          "uid=alice,ou=users,dc=netkingdom,dc=local",
+				Username:    "alice",
+				DisplayName: "Alice Example",
+				Email:       "alice@netkingdom.local",
+				Enabled:     true,
+				Groups:      []string{"uid=admins,ou=groups,dc=netkingdom,dc=local"},
+				Roles:       []string{},
+			},
+			{
+				ID:          "uid=bob,ou=users,dc=netkingdom,dc=local",
+				Username:    "bob",
+				DisplayName: "Bob Builder",
+				Email:       "bob@netkingdom.local",
+				Enabled:     true,
+				Groups:      []string{"uid=developers,ou=groups,dc=netkingdom,dc=local"},
+				Roles:       []string{},
+			},
+			{
+				ID:          "uid=carol,ou=users,dc=netkingdom,dc=local",
+				Username:    "carol",
+				DisplayName: "Carol Admin",
+				Email:       "carol@netkingdom.local",
+				Enabled:     false,
+				Groups:      []string{},
+				Roles:       []string{},
+			},
+		},
+		Groups: []domain.Group{
+			{
+				ID:          "uid=admins,ou=groups,dc=netkingdom,dc=local",
+				Name:        "admins",
+				Description: "Administrators",
+				Members:     []string{"uid=alice,ou=users,dc=netkingdom,dc=local"},
+			},
+			{
+				ID:          "uid=developers,ou=groups,dc=netkingdom,dc=local",
+				Name:        "developers",
+				Description: "Developers",
+				Members:     []string{"uid=bob,ou=users,dc=netkingdom,dc=local"},
+			},
+		},
+		Memberships: []domain.Membership{
+			{UserID: "uid=alice,ou=users,dc=netkingdom,dc=local", GroupID: "uid=admins,ou=groups,dc=netkingdom,dc=local"},
+			{UserID: "uid=bob,ou=users,dc=netkingdom,dc=local", GroupID: "uid=developers,ou=groups,dc=netkingdom,dc=local"},
+		},
+		ExportedAt:     time.Date(2026, 3, 13, 0, 0, 0, 0, time.UTC),
+		ProfileVersion: "0.1",
+	}
+}
+
+// testClients returns sample canonical clients for migration tests.
+func testClients() []domain.Client {
+	return []domain.Client{
+		{
+			ClientID:      "demo-app",
+			DisplayName:   "Demo Application",
+			RedirectURIs:  []string{"http://localhost:3000/callback", "https://demo.netkingdom.local/callback"},
+			AllowedScopes: []string{"openid", "profile", "email", "groups"},
+			GrantTypes:    []string{"authorization_code"},
+			ClientType:    "public",
+		},
+		{
+			ClientID:      "api-client",
+			DisplayName:   "API Client",
+			RedirectURIs:  []string{"https://api.netkingdom.local/oauth/callback"},
+			AllowedScopes: []string{"openid", "profile"},
+			GrantTypes:    []string{"authorization_code"},
+			ClientType:    "confidential",
+			SecretRef:     "api-client-secret",
+		},
+	}
+}