Phase 0 milestone 0.6: 501-stub routers for remaining entities

26 stub entities (every matrix entity except Registrant, User, Role,
AuditLog) get a router from framework/stub_router.py: one route per
matrix action (List, Search, Create, View, Edit, Delete, Restore,
VersionHistory). Each route runs the real RBAC check, writes an audit
row, then returns 501. Source RFP C.5.7.27.

- Registry in src/ypms/stubs.py; test fails if a matrix entity is
  neither real nor stubbed.
- tests/test_stubs.py sweeps entity x role x route against the matrix
  JSON: 501 + exactly one audit row when granted, 403 + none when not.
  FERPA/CFSA stubs pinned closed to non-examiner roles.
- Registrant restore now gated on the matrix's Restore action (was
  Edit, the vendored-factory convention); only the super-role holds it.
- Test fixtures (roles, make_user, api) lifted to conftest; one app per
  session (route construction dominated runtime) and a shared password
  hash for minted-token users.

138 tests passing, ruff + mypy clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/conftest.py

@@ -12,7 +12,8 @@ imports `ypms.main` (which instantiates the FastAPI app at import time).
 from __future__ import annotations
 
 import os
-from collections.abc import Iterator
+from collections.abc import Callable, Iterator
+from typing import Any
 
 os.environ.setdefault("DATABASE_URL", "sqlite:///:memory:")
 os.environ.setdefault("JWT_SECRET", "test-secret")
@@ -70,3 +71,81 @@ def client() -> Iterator[TestClient]:
     app = create_app()
     with TestClient(app) as c:
         yield c
+
+
+# ---------------- seeded RBAC + authenticated API client ----------------
+
+Headers = dict[str, str]
+
+
+@pytest.fixture
+def roles(db: Session) -> dict[str, Any]:
+    """All seed roles with the real permissions matrix loaded."""
+    from ypms.seed.permissions import seed_permissions
+    from ypms.seed.run import seed_roles
+
+    r = seed_roles(db)
+    seed_permissions(db, r)
+    db.flush()
+    return r
+
+
+_HASH_CACHE: list[str] = []
+
+
+def _unused_password_hash(hasher: Callable[[str], str]) -> str:
+    # PBKDF2 is deliberately slow; these users authenticate by minted token,
+    # so one hash shared across the session is enough.
+    if not _HASH_CACHE:
+        _HASH_CACHE.append(hasher("unused-in-these-tests"))
+    return _HASH_CACHE[0]
+
+
+@pytest.fixture
+def make_user(db: Session, roles: dict[str, Any]) -> Callable[..., tuple[Any, Headers]]:
+    """Factory: make_user("name", "ROLE_A", ...) -> (User, auth headers)."""
+    from ypms.auth.security import create_access_token, hash_password
+    from ypms.users.models import ASSURANCE_STANDARD, User, UserRole
+
+    def _make(username: str, *role_codes: str) -> tuple[User, Headers]:
+        user = User(
+            username=username,
+            password_hash=_unused_password_hash(hash_password),
+            is_active=True,
+            assurance_level=ASSURANCE_STANDARD,
+        )
+        db.add(user)
+        db.flush()
+        for code in role_codes:
+            db.add(UserRole(user_id=user.id, role_id=roles[code].id))
+        db.flush()
+        db.refresh(user)
+        token = create_access_token(
+            sub=username, uid=user.id, roles=list(role_codes),
+            assurance_level=ASSURANCE_STANDARD, mfa_verified=False,
+        )
+        return user, {"Authorization": f"Bearer {token}"}
+
+    return _make
+
+
+@pytest.fixture(scope="session")
+def _shared_app() -> Any:
+    """One app per session: building ~240 routes costs ~0.1s per create_app()."""
+    from ypms.main import create_app
+
+    return create_app()
+
+
+@pytest.fixture
+def api(db: Session, _shared_app: Any) -> Iterator[TestClient]:
+    """TestClient on the shared app, wired to the per-test SQLite session."""
+    from ypms.db import get_db
+
+    def _override() -> Iterator[Session]:
+        yield db
+
+    _shared_app.dependency_overrides[get_db] = _override
+    with TestClient(_shared_app) as c:
+        yield c
+    _shared_app.dependency_overrides.clear()