test(registry-api): route-level coverage for verdict_source owner-scope gate (closes #4378)

[bokelley]

Summary

Adds the route-level integration test the #4378 ticket explicitly asks for. PR #4389 shipped 6 unit tests pinning `resolveOwnerMembership`'s `is_owner` semantics; this PR layers the Express handler on top so the gate is verified end-to-end against the actual response shape, not just the dispatcher's return value.

What's tested

Four cases, all hitting `GET /api/registry/agents/:encodedUrl/compliance` via supertest against a real Postgres:

1. Anonymous caller (no `req.user`) — every owner-only key (`verdict_source`, `membership_tier`, `membership_tier_label`, `subscription_status`, `is_api_access_tier`) is present on the response (so non-owners can't infer ownership from `Object.keys` shape), but all carry null/false.
2. Cross-org caller (authenticated user with no membership in the owning org) — same null/false shape as anonymous.
3. Owner caller (`company_standard` tier, `active` subscription) — `verdict_source='owner_test'`, `membership_tier='company_standard'`, `is_api_access_tier=true`.
4. Owner of a tier=NULL org — `verdict_source` still populated (the gate is `is_owner`, not `is_api_access_tier`), `membership_tier=null`, `is_api_access_tier=false`. Pins the contract that Explorer-tier owners still get the UX cue per the test: route-level coverage for verdict_source owner-scope gate #4378 reasoning.

Test plan

• `docker compose up -d postgres && createdb adcp_test && DATABASE_URL=... npx vitest run` — 4/4 pass against fresh Postgres with migrations applied.
• `npx tsc --noEmit -p server/tsconfig.json` clean.
• `npm run precommit` green (full suite).
• CI hits this via `server/tests/integration/**` — verified locally by following the pattern in `registry-api-agent-refresh.test.ts` which already runs there.

Pattern reference

Built on `server/tests/integration/registry-api-agent-refresh.test.ts` — same auth/csrf/stripe mock pattern, same DB-fixture shape (organizations + organization_memberships + member_profiles.agents + agent_compliance_runs + agent_compliance_status), same supertest invocation.

Closes #4378.

🤖 Generated with Claude Code