fix(rest): build a real IHttpRequest in the #7541 pin instead of a partial literal

The new test drove both handlers with `{ params, query }` object literals, which
do not satisfy `IHttpRequest` — 2 x TS2345, taking @objectstack/rest's TEST_DEBT
from its recorded 155 to 157. That ledger is a ratchet: it may only shrink.

Fixed at the source rather than by raising the entry, and the fix is not
bookkeeping. `enforceAuth` runs BEFORE either predicate under test and reads
`req.method` and `req.path` — both `undefined` in the old literals — so the pin
was measuring statuses a real caller would not necessarily get. The helper now
returns a complete `IHttpRequest` typed against the contract, so the gate reads
zero errors from this file AND the measured 200/404/501 are the statuses the
real request shape produces.

Not cast to `any`: the neighbouring conformance test casts its handler that way,
but a cast here would have hidden exactly the missing members that make the
measurement faithful.

Measured with the gate's own command (packages/rest/tsconfig.json with the test
globs dropped from `exclude`): 157 before, 155 after — equal to the recorded
ledger entry, which is left untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GHTC2SvMXprxV9eEHqfbCP

Author: claude

packages/rest/src/discovery-search-capability-agreement.test.ts

@@ -23,9 +23,21 @@
 // keep the agreement from holding vacuously.
 
 import { describe, it, expect, vi } from 'vitest';
+import type { IHttpRequest } from '@objectstack/spec/contracts';
 import { ObjectStackProtocolImplementation } from '@objectstack/metadata-protocol';
 import { RestServer } from './rest-server.js';
 
+/**
+ * A complete `IHttpRequest`, typed against the contract rather than cast to
+ * `any`. Not ceremony: `enforceAuth` — which runs before either predicate under
+ * test — reads `method` and `path`, so a partial literal would exercise the
+ * gate with `undefined` on both. Building the real shape is what makes the
+ * measured statuses below the statuses a real caller gets.
+ */
+function request(path: string, query: Record<string, string> = {}): IHttpRequest {
+  return { params: {}, query, headers: {}, method: 'GET', path };
+}
+
 function createMockServer() {
   return {
     get: vi.fn(), post: vi.fn(), put: vi.fn(), delete: vi.fn(), patch: vi.fn(),
@@ -109,7 +121,7 @@ async function measure(opts: {
     json: (b: any) => { discoveryBody = b; },
     status: () => discoveryRes,
   };
-  await discoveryEntry.handler({ params: {}, query: {} }, discoveryRes);
+  await discoveryEntry.handler(request('/api/v1/discovery'), discoveryRes);
   const declared = discoveryBody?.capabilities?.search?.enabled;
 
   const searchEntry = routes.get('GET', '/api/v1/search');
@@ -124,7 +136,7 @@ async function measure(opts: {
     status: (s: number) => { status = s; return searchRes; },
     json: (b: any) => { searchBody = b; },
   };
-  await searchEntry.handler({ params: {}, query: { q: 'audit' } }, searchRes);
+  await searchEntry.handler(request('/api/v1/search', { q: 'audit' }), searchRes);
   return { declared, status, hits: searchBody?.hits?.length ?? 0 };
 }