Comprehensive role × action permission matrix test. Key findings:
1. source_user: 0/20 blocks — ALL main app views accessible (should be restricted)
2. config_dashboard: accessible by ALL roles (should be px_admin only)
3. Many POST actions return 302 (redirect with error) instead of 403 when
blocked — the action is actually denied but HTTP status looks like success.
This is a design pattern (catch PermissionDenied → redirect with message).
4. physician/nurse/staff/viewer can reach complaint_change_status, inquiry_respond,
observation_change_status, action_create, project_create — these may be real
gaps OR the 302-redirect pattern (need state-based verification).
The test surfaces both real RBAC gaps and areas where the redirect-instead-of-403
pattern makes HTTP-status-based detection unreliable.
