fix(housekeeping): harden people account workflows

src/actions/people-shared-wrappers.test.ts

@@ -8,13 +8,11 @@ const { execute, staff } = vi.hoisted(() => ({
 }));
 
 vi.mock("@/features/housekeeping/domains/people/services/mutations", () => ({
-	createLegacyPeopleMutationContext: vi.fn(
-		(actor, permission, correlationId) => ({
-			actor,
-			permission,
-			correlationId,
-		}),
-	),
+	createPeopleMutationInvocation: vi.fn((staff, correlationId) => ({
+		expectedActorId: staff.id,
+		correlationId,
+		legacy: true,
+	})),
 	peopleMutationService: { execute },
 }));
 vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
@@ -98,12 +96,13 @@ describe("legacy user safe-action wrappers", () => {
 			}>
 		)({ userId: 7 });
 
-		expect(
-			execute.mock.calls.map((call) => [call[0].permission, call[1]]),
-		).toEqual([
-			["admin.users.edit", "user.update"],
-			["admin.users.ban", "user.ban"],
-			["admin.users.reset_password", "user.reset-password"],
+		expect(execute.mock.calls.map((call) => call[1])).toEqual([
+			"user.update",
+			"user.ban",
+			"user.reset-password",
+		]);
+		expect(execute.mock.calls.map((call) => call[0].expectedActorId)).toEqual([
+			1, 1, 1,
 		]);
 		expect(reset.data.newPassword).toBe("temporary-password");
 	});
@@ -113,7 +112,7 @@ describe("legacy application and word-filter wrappers", () => {
 	it("keeps tolerant application dismissal and /admin revalidation", async () => {
 		await dismissApplication(form({ id: "9" }));
 		expect(execute).toHaveBeenCalledWith(
-			expect.objectContaining({ permission: "admin.users.edit" }),
+			expect.objectContaining({ expectedActorId: 1 }),
 			"application.decide",
 			{ applicationId: 9, decision: "dismiss" },
 		);