qNFT tests use plaintext token fixtures after hash-only auth migration

[servathadi]

Summary

The qNFT service test fixture still writes plaintext token fields to tokens.json, but the current authentication boundary accepts only token_hash (SHA-256) or supported bcrypt hashes. Five protected qNFT tests therefore fail at authentication with 401 invalid or inactive bearer token before exercising their declared behavior.

Verified on current origin/main:

• commit: 537eda1c96ff24b65b381b304af4256c9cad2206
• test: tests/services/economy/test_qnft_app.py
• auth boundary: sos/kernel/auth.py::_check_tokens_json

Reproduction

PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider \
  tests/services/economy/test_qnft_app.py

Observed:

• 5 failed, 1 passed
• every protected /qnft request is rejected with 401
• the system-token 403/402/200 assertions are never reached

Root cause

The fixture currently creates entries shaped like:

{"label": "system", "token": "tk_system", ...}
{"label": "acme-tenant", "token": "tk_acme", ...}

The production auth code explicitly removed plaintext-token equality and computes SHA-256 of the presented bearer before comparing it with entry["token_hash"].

Proposed fix

Keep production authentication unchanged. Update only the test fixture:

• replace the two raw token fields with the SHA-256 token_hash values for tk_system and tk_acme;
• give the system fixture the wildcard scope required by the qNFT system action;
• preserve tenant/project scope on the tenant fixture.

A bounded Flight-0 worktree already demonstrated this shape:

• only tests/services/economy/test_qnft_app.py changed;
• exact module result became 6 passed, 0 failed;
• an independent read-only verifier reproduced the result;
• production auth was untouched.

Acceptance criteria

• The fixture stores no plaintext bearer token.
• test_qnft_app.py reports 6 passed.
• The non-system token reaches the authorization boundary and returns the declared 403.
• Insufficient funds reaches the economy boundary and returns the declared 402.
• No production auth fallback to plaintext comparison is added.
• Relevant broader auth/economy tests remain green.