testing/cross_backend/origin_scope.ts

Cross-backend parity suite for the origin check's scope: every path, not only /api.

Both spines check the Origin of every request — the TS spine mounts the check on every path (ORIGIN_MIDDLEWARE_PATH), the Rust spine behind every route group of fuz_http::compose_stack, the fallback included — and leave a path out only by a named carve-out with its reason. The front-door table (transport_composition.ts) pins the check on the /api transports; this suite pins it off /api, on the route both spine test servers serve there, GET /ready:

• foreign Origin → 403 forbidden_origin — the check runs on a path outside /api.
• absent Origin → passes — a probe or CLI client sends none, so the wider scope costs it nothing.
• allowed Origin → passes — the control: the check admits its own origin rather than refusing every browser.

And on a path neither server routes, which reaches each spine's fallback:

• foreign Origin → 403 forbidden_origin, absent → 404 — the fallback is behind the check, not attached after it.
• an over-cap POST with a declared Content-Length and a foreign Origin → 413 payload_too_large — the body cap comes ahead of the origin check on the fallback too (413-first holds for a declared length).

The /ready rows are gated on capabilities.ready, which every spine test server advertises; the unrouted rows run on every backend. Runs both legs via the shared {setup_test, capabilities} protocol: the in-process leg (cross_backend/origin_scope_parity.db.test.ts, plain `gro test) and the cross-process leg (cross_backend/origin_scope.cross.test.ts`, the TS spine binaries + Rust testing_spine_stub over real HTTP).