fix(test): unskip user-context integration tests — fix WorkOS mock shape (#3319)

[bokelley]

Closes #3319

Summary

server/tests/integration/user-context.test.ts was describe.skip because all 10 WorkOS-path tests failed with expected undefined to be defined. Three root causes, three fixes:

1. Wrong mock export shape (core fix)
vi.mock('workos-client.js') exported { workos: { userManagement: ... } } but workos-client.ts only exports named functions. member-context.ts calls getWorkos().userManagement.*, so getWorkos was undefined. Fix: export getWorkos: () => mockInstance from the mock factory.

2. Missing status: 'active' on membership mock data
getWebMemberContext filters with .find(m => m.status === 'active') and resolveUserRole skips memberships where status !== 'active'. Without the field, organizationId stayed null and the function returned early before building any org/membership context. Fix: add status: 'active' (and userId) to all membership objects in the mock.

3. 404 never triggered for non-existent WorkOS users
getWebMemberContext initializes is_mapped: true (correct for authenticated sessions). On getUser failure it returned that partial context, so the route's !is_mapped && !slack_user && !workos_user guard never fired. Fix: set context.is_mapped = false only when the WorkOS error is a genuine 404 (error.status === 404 || error.code === 'entity_not_found') — transient failures leave is_mapped: true so authenticated sessions degrade gracefully rather than being treated as anonymous. The test mock now throws a 404-shaped error for user_nonexistent.

Non-breaking justification: the getWebMemberContext change only affects the is_mapped flag when WorkOS returns a hard 404 for a user ID that doesn't exist. All callers that check organization (agent-oauth.ts) or wrap in try/catch (addie-chat.ts) are unaffected. For the admin debug endpoint, the behavior is now correct: non-existent user ID → 404.

Pre-PR review

• code-reviewer: approved — no blockers on final diff; error.status === 404 || error.code === 'entity_not_found' narrowing correctly avoids transient-error demotion; mock shape matches module exports
• dx-expert: approved — simpler mock approach (no @workos-inc/node class mock needed) confirmed safe since no code path in this test instantiates WorkOS directly; dual-discriminant listOrganizationMemberships mock is idiomatic for mutually-exclusive WorkOS call patterns

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_01S4yASsF6fSh3gqWGjoJ2mq

---

Generated by Claude Code