test: massive coverage expansion — 15 new test modules + assistant tool fixes + orthogonal testing

- 10 translate plugin test files (100% coverage on 12 modules)
- assistant/handler tools: 85+ tests covering dispatch, registry, resolvers, routes, llm_planner, 13 tool handlers
- clean release: artifact_catalog_loader, mappers, approval, publication tests
- API routes: translate_helpers, validation_service extensions, datasets to 100%
- notifications: providers/service tests
- services: profile_preference_service
- docs/orthogonal-test-report.md — full speckit.tests audit
- Fixes: 3 git_base async mock failures, 4 assistant handler permission-check patches
- .gitignore: coverage artifacts

backend/tests/api/test_admin.py

@@ -94,13 +94,32 @@ class TestCreateUser:
 
     def test_create_user_success(self):
         """Happy path: user created with 201."""
+        from datetime import datetime
         from src.core.database import get_auth_db
+
         mock_session = MagicMock()
         mock_repo = MagicMock()
         mock_repo.get_user_by_username.return_value = None
-        mock_repo.get_role_by_name.side_effect = lambda name: (
-            MagicMock(id=f"role-{name}", name=name, permissions=[]) if name == "Admin" else None
-        )
+
+        # Build a proper role mock with string attributes, not MagicMock(name=...)
+        def _get_role_by_name(name):
+            if name != "Admin":
+                return None
+            role = MagicMock()
+            role.id = f"role-{name}"
+            role.name = name
+            role.description = "Administrator role"
+            role.permissions = []
+            return role
+
+        mock_repo.get_role_by_name.side_effect = _get_role_by_name
+
+        # Make mock_session.refresh set fields the response schema needs
+        def _refresh_side_effect(obj):
+            obj.id = "new-user-id"
+            obj.created_at = datetime.now()
+
+        mock_session.refresh.side_effect = _refresh_side_effect
 
         with patch("src.api.routes.admin.AuthRepository", return_value=mock_repo):
             client = _make_client({get_auth_db: lambda: mock_session})
@@ -179,6 +198,8 @@ class TestUpdateUser:
         existing_user.username = "oldname"
         existing_user.email = "old@example.com"
         existing_user.is_active = True
+        existing_user.auth_source = "LOCAL"
+        existing_user.created_at = __import__("datetime").datetime.now()
         existing_user.roles = []
         mock_repo.get_user_by_id.return_value = existing_user
 
@@ -263,7 +284,16 @@ class TestCreateRole:
         mock_session = MagicMock()
         mock_session.query.return_value.filter.return_value.first.return_value = None
         mock_repo = MagicMock()
-        mock_repo.get_permission_by_id.return_value = MagicMock(id="perm-1")
+        mock_perm = MagicMock()
+        mock_perm.id = "perm-1"
+        mock_perm.resource = "users"
+        mock_perm.action = "read"
+        mock_repo.get_permission_by_id.return_value = mock_perm
+
+        def _refresh_side_effect(obj):
+            obj.id = "new-role-id"
+
+        mock_session.refresh.side_effect = _refresh_side_effect
 
         with patch("src.api.routes.admin.AuthRepository", return_value=mock_repo):
             from src.core.database import get_auth_db
@@ -433,6 +463,12 @@ class TestCreateAdMapping:
     def test_create_mapping_success(self):
         """Happy path: AD mapping created."""
         mock_session = MagicMock()
+        mock_session.add = MagicMock()
+
+        def _refresh_side_effect(obj):
+            obj.id = "new-mapping-id"
+
+        mock_session.refresh.side_effect = _refresh_side_effect
 
         from src.core.database import get_auth_db
         client = _make_client({get_auth_db: lambda: mock_session})