feat(l1): category service (defaults + hard floor) and AI action keys

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/tests/test_l1_category_service.py

@@ -0,0 +1,16 @@
+from app.services.l1_category_service import (
+    DEFAULT_L1_CATEGORIES, HARD_FLOOR_FORBIDDEN, is_category_enabled,
+)
+
+
+def test_defaults_and_hard_floor_present():
+    assert "password_reset" in DEFAULT_L1_CATEGORIES
+    assert "registry_edit" in HARD_FLOOR_FORBIDDEN  # representative forbidden action key
+    assert len(DEFAULT_L1_CATEGORIES) == 10
+
+
+def test_is_category_enabled():
+    enabled = ["printer", "vpn_connect"]
+    assert is_category_enabled("printer", enabled) is True
+    assert is_category_enabled("registry_edit", enabled) is False
+    assert is_category_enabled("unknown", enabled) is False