fix: fail closed backend capabilities and isolate gate smoke

tests/convex.test.ts

@@ -471,4 +471,23 @@ describe("Convex persistence", () => {
       else process.env.APP_CAPABILITY_ALLOWLIST = previous;
     }
   });
+
+  test("backend rollout gate fails closed when propagation is missing or malformed", async () => {
+    const previous = process.env.APP_CAPABILITY_ALLOWLIST;
+    try {
+      for (const value of [undefined, "not-a-capability"]) {
+        if (value === undefined) delete process.env.APP_CAPABILITY_ALLOWLIST;
+        else process.env.APP_CAPABILITY_ALLOWLIST = value;
+        process.env.APP_AUTH_ISSUER = "https://auth.example.test";
+        const t = convexTest({ schema, modules });
+        const loggedIn = await login(t, { sessionHash: `missing-gate-${value ?? 'unset'}` });
+        const browser = t.withIdentity({ subject: loggedIn.userId, issuer: "https://auth.example.test", sid: loggedIn.sessionId } as any);
+        await expect(browser.query(statusQuery("characters"), {})).resolves.toBeNull();
+        await expect(t.mutation(mutation("bridgeBeginSync"), { ...bridge, userId: loggedIn.userId, characterId: 100 })).rejects.toThrow("asset_sync");
+      }
+    } finally {
+      if (previous === undefined) delete process.env.APP_CAPABILITY_ALLOWLIST;
+      else process.env.APP_CAPABILITY_ALLOWLIST = previous;
+    }
+  });
 });