feat: re-check central RTC authorization right before every write (GET /v1/agents/me/authorizations), human labels on the cClassTrib control page, final corpus/scale evidence; 1.2.1

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/tests/test_control_panel_pages.py

@@ -689,3 +689,19 @@ def test_panel_shows_rtc_products_summary_and_the_pending_message_only_when_rtc_
     assert "Preenchimento automático" in on and "Desativada" in on and f"/agents/{agent_id}/rtc" in on
     for legacy in ("Escopo anterior", "Escopo ampliado"):
         assert legacy not in on
+
+
+def test_rtc_control_page_shows_human_labels_and_a_catalog_column_never_raw_enums():
+    from central.app.panel_presentation import abort_reason_label, audit_outcome_label, candidate_status_label, catalog_state_label, blocker_reason_label, blocker_type_label, rtc_rule_label
+    assert candidate_status_label("APPROVED") == "Aprovado" and audit_outcome_label("ROLLED_BACK") == "Revertido"
+    assert rtc_rule_label("RTC-R4") == "Sugestão sem autorização de preenchimento (RTC-R4)"
+    assert blocker_reason_label("INSUFFICIENT_EVIDENCE") == "Evidência fiscal insuficiente"
+    assert blocker_type_label("CCLASSTRIB_CONFLICT") == "cClassTrib existente diverge da classificação proposta"
+    assert catalog_state_label("MISSING_LOCAL") == "Classe oficial ausente no catálogo local do SGV"
+    assert abort_reason_label("VALUE_ALREADY_SET_NEVER_OVERWRITTEN") == "cClassTrib existente diverge da classificação proposta"
+    client, agent_id, _ = _panel_client()
+    page = client.get(f"/agents/{agent_id}/rtc").text
+    for header in ("cClassTrib atual", "cClassTrib proposto", "Fundamento", "Catálogo", "Situação", "Descrição"):
+        assert header in page
+    for raw in ("PENDING</td>", "APPLIED</td>", "ABORTED"):
+        assert raw not in page

central/tests/test_health.py

@@ -17,7 +17,7 @@ def test_health_is_unavailable_when_database_is_down():
 
 def test_version_endpoint_reports_release_and_fiscal_versions():
     body = TestClient(create_app(database_probe=lambda: True)).get("/version").json()
-    assert body["version"] == "1.2.0" and body["api_compat"] == "1.0" and body["engine_version"] and body["decision_version"]
+    assert body["version"] == "1.2.1" and body["api_compat"] == "1.0" and body["engine_version"] and body["decision_version"]
 
 
 def test_production_refuses_the_dev_token(monkeypatch):

central/tests/test_rtc_security.py

@@ -85,3 +85,15 @@ def test_audit_rows_never_carry_credentials_or_tokens():
         blob = repr([getattr(row, c.name) for c in RtcWriteAudit.__table__.columns])
         assert "password" not in blob.lower() and "'t'" not in blob and "Bearer" not in blob
         assert not any("pass" in c.name or "token" in c.name or "secret" in c.name for c in RtcWriteAudit.__table__.columns)
+
+
+def test_agent_can_reread_only_its_own_current_authorization_and_it_follows_the_operator():
+    client, engine = _client()
+    hb(client)
+    assert client.get("/v1/agents/me/authorizations").status_code in (401, 403)                     # requires the Agent credential
+    assert client.get("/v1/agents/me/authorizations", headers=H).json()["rtc_write_mode"] == "DISABLED"
+    with Session(engine) as s:
+        s.scalars(select(Installation)).one().rtc_write_mode = "ENABLED"
+        s.commit()
+    body = client.get("/v1/agents/me/authorizations", headers=H).json()
+    assert body["rtc_write_mode"] == "ENABLED" and set(body) == {"rtc_write_mode", "rtc_approved_codes", "rtc_rollbacks"}