test(security): cover tenant-scope, settings authz allow paths, auth gateways

Cluster 1 der Testabdeckungs-Initiative (.agents/runs/TEST-SEC-COVERAGE-001).
+38 Tests / +233 Assertions, nur tests/** veraendert.

- SettingsAuthorizationPolicyTest: Allow-Pfade fuer UPDATE/BRANDING_UPDATE/
  TOKENS_REVOKE/USER_LIFECYCLE_RUN plus Unknown-Ability — schliesst die
  Halb-Test-Luecke, die zuvor nur Deny-Pfade fuer 4 von 5 Abilities pruefte.
- AssignableRoleServiceTest: neu (GR-TEST-001, vorher nur transitiv via
  UserAssignmentServiceTest gedeckt).
- AuthCryptoGatewayTest: neu (Roundtrip + Fehlerpfad, GR-SEC-005).
- AuthSettingsGatewayTest: neu (Delegation zu 5 Settings-Sub-Gateways).
- UserTenantContextServiceTest: neu, 18 Tests, Tenant-Scope-Logik
  (GR-SEC-009) — current/primary/fallback, inactive-filter, assign-checks.

LdapConnectionGateway und OidcHttpGateway bleiben bewusst ohne Direkttests:
beide sind architektonische Test-Seams (dokumentiert im Docblock bzw. reiner
statischer Curl-Delegator). Ihre Logik ist ueber Konsumenten-Tests
(LdapAuthServiceTest, MicrosoftOidcServiceTest) bereits gedeckt.

Gates: QG-001 (1945 Tests) / QG-002 (PHPStan L5) / QG-003 (Architecture) /
QG-006 (php-cs-fixer) pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/Service/Auth/AuthCryptoGatewayTest.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Auth;
+
+use MintyPHP\Service\Auth\AuthCryptoGateway;
+use PHPUnit\Framework\TestCase;
+
+final class AuthCryptoGatewayTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        if (!defined('APP_CRYPTO_KEY')) {
+            define('APP_CRYPTO_KEY', str_repeat('ab', 32));
+        }
+    }
+
+    public function testIsConfiguredDelegatesToCrypto(): void
+    {
+        $gateway = new AuthCryptoGateway();
+
+        $this->assertTrue($gateway->isConfigured());
+    }
+
+    public function testEncryptDecryptRoundTripThroughGateway(): void
+    {
+        $gateway = new AuthCryptoGateway();
+        $plaintext = 'sso-client-secret';
+
+        $encrypted = $gateway->encryptString($plaintext);
+
+        $this->assertNotSame($plaintext, $encrypted);
+        $this->assertSame($plaintext, $gateway->decryptString($encrypted));
+    }
+
+    public function testDecryptStringThrowsOnMalformedInput(): void
+    {
+        $gateway = new AuthCryptoGateway();
+
+        $this->expectException(\RuntimeException::class);
+        $gateway->decryptString('not-a-valid-payload');
+    }
+
+    public function testEncryptProducesDifferentCiphertextEachCall(): void
+    {
+        $gateway = new AuthCryptoGateway();
+
+        $this->assertNotSame(
+            $gateway->encryptString('same-value'),
+            $gateway->encryptString('same-value'),
+        );
+    }
+}