M12: complete daily operations cycle

backend/tests/test_vehicles.py

@@ -37,3 +37,44 @@ def test_vehicle_detail_includes_related_records(ops_client):
 def test_vehicle_detail_404_for_unknown_ref(ops_client):
     response = ops_client.get("/api/v1/vehicles/MO-999")
     assert response.status_code == 404
+
+
+def test_manager_can_record_maintenance_and_release_vehicle(ops_client):
+    vehicle = ops_client.get("/api/v1/vehicles", params={"status": "available"}).json()[0]
+    response = ops_client.post(
+        f"/api/v1/vehicles/{vehicle['public_ref']}/maintenance",
+        json={
+            "occurred_at": "2051-01-15T09:00:00Z",
+            "odometer_km": vehicle["odometer_km"] + 100,
+            "category": "periodic_service",
+            "summary": "Periodic service completed and safety checks passed.",
+            "next_service_km": vehicle["odometer_km"] + 20100,
+            "mark_maintenance": True,
+        },
+    )
+    assert response.status_code == 201
+    detail = ops_client.get(f"/api/v1/vehicles/{vehicle['public_ref']}").json()
+    assert detail["operational_status"] == "maintenance"
+    assert any(
+        item["public_ref"] == response.json()["public_ref"]
+        for item in detail["maintenance"]
+    )
+    released = ops_client.post(
+        f"/api/v1/vehicles/{vehicle['public_ref']}/release",
+        json={"reason": "Service completed and vehicle inspected"},
+    )
+    assert released.status_code == 200
+    assert released.json()["operational_status"] == "available"
+
+
+def test_employee_cannot_record_maintenance(employee_client):
+    response = employee_client.post(
+        "/api/v1/vehicles/MO-001/maintenance",
+        json={
+            "occurred_at": "2051-01-15T09:00:00Z",
+            "odometer_km": 100,
+            "category": "repair",
+            "summary": "Unauthorised attempt",
+        },
+    )
+    assert response.status_code == 403