fix: index many-to-many query invalidation

tests/unit/navigation-policy.test.ts

@@ -4,6 +4,7 @@ import {
   NAVIGATION_ROUTES,
   ROUTE_REGISTRY,
 } from "../../src/features/installed-feature-contracts.ts";
+import type { RouteDefinition } from "../../src/contracts/routes.ts";
 import {
   createRedirectLoopGuard,
   decideRouteAccess,
@@ -29,12 +30,20 @@ describe("installed route registry", () => {
   });
 
   it("treats every non-public route as explicitly session-required", () => {
-    expect(ROUTE_REGISTRY.REFERENCE_RESOURCE_LIST.access).toBe(
-      "session-required",
-    );
+    const protectedRoutes = Object.values(
+      ROUTE_REGISTRY as Readonly<Record<string, RouteDefinition>>,
+    ).filter((route) => route.access !== "public");
+
     expect(
-      decideRouteAccess("REFERENCE_RESOURCE_LIST", "unauthenticated"),
-    ).toEqual({ allowed: false, action: "show-sign-in" });
+      protectedRoutes.every((route) => route.access === "session-required"),
+    ).toBe(true);
+    for (const route of protectedRoutes) {
+      expect(route.access).toBe("session-required");
+      expect(decideRouteAccess(route.routeId, "unauthenticated")).toEqual({
+        allowed: false,
+        action: "show-sign-in",
+      });
+    }
   });
 
   it("bounds automatic redirects by pair and maximum hops", () => {