testing/cross_backend/origin.ts

Cross-backend parity suite for Origin verification.

Origin checking is middleware that runs *before* the RPC dispatcher and returns a flat REST {error} body — not a JSON-RPC envelope — so it doesn't fit the envelope-shaped conformance-table runner. This dedicated imperative suite drives raw transport calls instead, mirroring how the in-process origin tests were already hand-rolled. Two cases:

• disallowed Origin → 403 forbidden_origin, refused before any handler runs (the allowlist rejects the cross-origin request even with a valid session cookie attached).
• absent Origin → request passes — non-browser / direct-access clients (curl, CLI, server-to-server) carry no Origin and must not be blocked; token auth is the control for those callers.

Runs both legs via the shared {setup_test, capabilities} protocol: the in-process leg (auth/origin_parity.db.test.ts, plain gro test) and the cross-process leg (cross_backend/origin.cross.test.ts, the TS spine binaries + Rust testing_spine_stub over real HTTP). Origin middleware is on every spine, so the suite is ungated.

$lib-free by contract (relative specifiers only), like the sibling cross-backend suites.