The route reached the local engine already — genSID() takes it and throws it
away — but never reached the backend, so the clearance could only issue a SID.
The payload mapping moves to shared/utils so it can be tested at all: app/
composables are outside the test glob, and the fallback chains and string
coercion in it were entirely uncovered.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
