refac: DELETE /v1/user/{id}?expected_role_id=N, user.remove audit event, 409 target_role_not_found, GetAll returns its error, Own-scope visibility filter moved into repos, JSON tags removed from use-case types

features/roles_sync_profile_role_card.qa.md

@@ -0,0 +1,28 @@
+# QA procedure: Profile role card (roles sync pass 6)
+
+Spec: features/roles_sync_profile_role_card.feature. Vitest + Vue Test Utils under `task test:web`, access from web/src/test/access.ts (ownerAccess, customAccess, writerAccess).
+
+## Honesty rules
+0. Baseline `task test:web` first. 1. Runner cannot execute: NOT RUN. 2. Report new and edited specs and baseline failures. 3. EN strings are asserted; FR for "Custom", "Locked", "Built-in" is proposed by the coder (gap G1).
+
+## Automated (Vitest)
+| Spec | Cases |
+|---|---|
+| views/__tests__/ProfileView.spec.ts (edit) | the three card states and their tag rows and order, no summary line, no "Assigned by" with an object, null and an absent key (replaces the slice 7 case that asserted "Assigned by Marta Alves"), See what I can do desktop dialog and mobile sheet, Close and focus return, live role change, skeleton, no GET /v1/role call |
+| lib/__tests__/permissions.spec.ts (edit) | role_assigned_by is still parsed but not used by Profile |
+| i18n/roleMessages.spec.ts (extend) | keys for Locked, Built-in, Custom in EN and FR |
+| components/__tests__/RoleBadge.spec.ts (extend if it exists) | the Owner crown icon and the locked variant |
+
+## Visual (task visual:check)
+Run `task visual:check -- profile`. States: Role card custom role, Role card Owner. Board sample data: Contributor (Custom) and Owner (Locked, Built-in), key line as in the design. Light, dark, desktop, mobile within 10 %. The card sits after the Account card (G8 of slice 7; the coder confirms against the board).
+
+## Manual checks
+1. Tab order: the link is reachable after the badges; focus returns after Close.
+2. Mobile 390 px: the badge row wraps without overflow, 44 px target for the link.
+3. `task lint:web` green; `task test:web` exit 0.
+
+## Design gaps and notes
+- G1 FR copy for the tags is not in the design.
+- G2 Backend `role_assigned_by` stays (user decision); the SPA ignores it.
+- G3 The design routes cite GET /v1/me; the real one is /v1/auth/me.
+- Leftover, out of scope: screens/profile.md Display name copy is stale.