Send a projected flex-auth caller token on every check

TENANT_ENGINE_FLEX_AUTH_TOKEN_FILE is read per request so hourly
projection rotation needs no restart. Missing or unreadable file fails
closed as a local deny and never calls flex-auth. Needed before
flex-auth-tenant-engine can enforce (FLEX-WP-0015-T02).

tests/test_flex_auth.py

@@ -1,3 +1,5 @@
+from pathlib import Path
+
 import httpx
 import pytest
 
@@ -89,3 +91,23 @@ def test_request_body_matches_schema_shape() -> None:
     assert seen["action"] == "tenant.create"
     assert seen["subject"] == {"id": "tenant-engine", "type": "service"}
     assert seen["resource"] == {"id": "t-1", "type": "tenant", "system": "tenant-engine"}
+
+
+def test_rotating_caller_token_is_read_for_each_check(tmp_path: Path) -> None:
+    token_file = tmp_path / "token"
+    token_file.write_text("token-one\n")
+    seen: list[str] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.append(request.headers["authorization"])
+        return httpx.Response(200, json={"id": "d-1", "effect": "allow"})
+
+    client = FlexAuthCheckClient(
+        base_url="https://flex-auth.example.test",
+        transport=httpx.MockTransport(handler),
+        bearer_token_file=str(token_file),
+    )
+    assert client.is_allowed(_request()) is True
+    token_file.write_text("token-two\n")
+    assert client.is_allowed(_request()) is True
+    assert seen == ["Bearer token-one", "Bearer token-two"]