1. Password policy
  ok    rejects a six-character password
  ok    rejects nine characters
  ok    accepts ten characters
  ok    accepts a passphrase
  ok    rejects a credential-stuffing hit
  ok    rejects beyond bcrypt input
  ok    the reason names the fix

2. Initials for the avatar
  ok    two words
  ok    three words use first and last
  ok    one word
  ok    extra spaces
  ok    empty is not blank output

3. Roles are declared, not implied
  ok    exactly three roles
  ok    every role has a plain-language note

4. Capability table
  ok    viewer cannot run audits
  ok    viewer cannot manage findings
  ok    viewer can view
  ok    analyst can run audits
  ok    analyst cannot manage users
  ok    admin holds every capability
  ok    no capability is open to everyone by accident

5. Signed out is the default
  ok    check() is false with no session
  ok    role() is empty
  ok    can(view) is false
  ok    unknown capability is false

25 passed, 0 failed