[feat](trx-frontend-http): add restricted Guest role

Assisted-By: Codex (GPT-5)
Signed-off-by: Stan Grams <sjg@haxx.space>

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/account-management.mjs

@@ -47,14 +47,16 @@ try {
       createRoles: [...document.querySelectorAll("#user-create-roles input")].map((input) => input.value),
       adminEnabledLocked: admin?.querySelector('input[type="checkbox"]')?.disabled,
       adminRoleLocked: role(admin, "administrator")?.disabled,
+      adminGuestLocked: role(admin, "guest")?.disabled,
       adminRemoveLocked: admin?.querySelector("button.danger")?.disabled,
       listenerEnabled: listener?.querySelector('input[type="checkbox"]')?.checked,
       listenerRead: role(listener, "read")?.checked,
     };
   });
-  assert.deepEqual(state.createRoles, ALL_ROLES);
+  assert.deepEqual(state.createRoles, ["guest", ...ALL_ROLES]);
   assert.equal(state.adminEnabledLocked, true);
   assert.equal(state.adminRoleLocked, true);
+  assert.equal(state.adminGuestLocked, true);
   assert.equal(state.adminRemoveLocked, true);
   assert.equal(state.listenerEnabled, false);
   assert.equal(state.listenerRead, true);
@@ -63,3 +65,23 @@ try {
   await browser.close();
   await fixture.close();
 }
+
+const guestFixture = await startWebFixture({
+  authSession: {
+    authenticated: true,
+    username: "guest",
+    roles: ["guest"],
+    auth_disabled: false,
+  },
+});
+const guestBrowser = await startBrowser(chromium);
+try {
+  await guestBrowser.page.goto(`${guestFixture.origin}/settings`, { waitUntil: "domcontentloaded" });
+  await guestBrowser.page.locator("#tab-settings").waitFor({ state: "visible" });
+  assert.equal(await guestBrowser.page.locator("#settings-account-tab").isVisible(), false);
+  assert.equal(await guestBrowser.page.locator("#settings-users-tab").isVisible(), false);
+  assert.deepEqual(guestBrowser.runtimeErrors, []);
+} finally {
+  await guestBrowser.browser.close();
+  await guestFixture.close();
+}

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/auth.test.mjs

@@ -15,9 +15,12 @@ function loadAuth(fetch) {
   return context.AuthApi;
 }
 
-test("role policy is centralized and preserves the Control-to-Read implication", () => {
+test("role policy centralizes Guest and implied read access", () => {
   const auth = loadAuth(async () => { throw new Error("unused"); });
-  assert.deepEqual(Array.from(auth.AUTH_ROLES), ["read", "control", "write", "administrator"]);
+  assert.deepEqual(Array.from(auth.AUTH_ROLES), ["guest", "read", "control", "write", "administrator"]);
+  assert.equal(auth.hasAuthRole(["guest"], "read"), true);
+  assert.equal(auth.hasAccountControls(["guest"]), false);
+  assert.equal(auth.hasAccountControls(["read"]), true);
   assert.equal(auth.hasAuthRole(["control"], "read"), true);
   assert.equal(auth.hasAuthRole(["control"], "write"), false);
   assert.equal(auth.hasAuthRole(["administrator"], "write"), true);

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/smoke.test.mjs

@@ -51,6 +51,7 @@ test("account lifecycle controls include self-service passwords and enable state
   assert.match(html, /id="account-password-form"/);
   assert.match(html, /id="user-create-enabled"/);
   assert.match(app, /changeOwnPassword/);
+  assert.match(app, /hasAccountControls\(authRoles\)/);
   assert.match(app, /enabledAdminCount/);
 });