Dev login no longer honors injected roles; self-service simulate/convert
blocks R4 disclosure grades like the UI and chat already do. Reuse of a
convert idempotency key with a different body returns 409. CT6 redeem qty
is derived from T+2 lots instead of a fixed 35000; CT7-05 and CT10-07
assertions follow. Update project memory and v1.1 post-fix test artifacts.