testing/cross_backend/ws_role_gated.ts

Cross-process role-gated WebSocket suite — a socket admitted by an endpoint's role gate (register_ws_endpoint's required_roles) loses it with the role.

A role gate decides who may hold a socket, and so who receives the endpoint's server pushes, which reach every admitted connection with no per-recipient filter. So both spines record the gating roles on each registration and close the account's gated sockets when a global grant of a listed role is revoked — with WS_CLOSE_PERMISSION_REVOKED, not the session-revoked code, since the credential is still good — and send nothing after the close. The ungated sockets of the same account, on the same transport, stay open: the gate is per endpoint, not per account. A scoped grant never admits at a role gate, so revoking one closes nothing.

Runs against a backend that mounts, beside its ungated ws_path, a second endpoint at gated_ws_path gated on gated_roles — which must include ROLE_ADMIN (the revoked global grant) and a role that can be granted both globally and scoped (the scoped revoke). fuz_app's spine binaries mount SPINE_ROLE_GATED_WS_PATH gated on SPINE_ROLE_GATED_WS_ROLES. Gated on capabilities.ws and capabilities.ws_role_gated; cross-process only.