- ProvisionOrg/User creates directories and paths correctly
- Invalid slugs rejected (path traversal, uppercase, specials)
- HKDF DEK is deterministic, unique per org, unique per user,
org≠user even with same input (different HKDF info param)
- Empty master key returns empty DEK (dev mode, no encryption)
- Lookup works after provision, returns false before
- DeleteUser removes directory and lookup entry
- Integration: OrgDB + PoolManager read/write through dual pools
- Multi-org isolation: same table name, different data per org
