M54: harden operations and demo resilience

backend/tests/test_hardening.py

@@ -174,11 +174,12 @@ def test_return_idempotency_key_rejects_different_body(ops_client):
 
 
 def test_return_callback_rejects_malformed_correlation_id(client):
+    event_id = str(uuid.uuid4())
     response = client.post(
         "/api/v1/integrations/n8n/return-callback",
-        json={"follow_up": "cleaning", "correlation_id": "nope"},
+        json={"event_id": event_id, "follow_up": "cleaning", "correlation_id": "nope"},
         headers={
-            "Idempotency-Key": str(uuid.uuid4()),
+            "Idempotency-Key": event_id,
             "X-Service-Token": get_settings().n8n_callback_token,
         },
     )
@@ -195,10 +196,14 @@ def test_blocked_checkout_booking_can_be_cancelled(ops_client):
         json={
             "customer_ref": "CUS-0002",
             "vehicle_ref": vehicle["public_ref"],
-            "requirements_complete": True,
             **window,
         },
     ).json()
+    confirmed = ops_client.post(
+        f"/api/v1/bookings/{booking['public_ref']}/complete-requirements",
+        json={"confirmation": "Licence and rental conditions checked"},
+    )
+    assert confirmed.status_code == 200
     checkout = ops_client.post(
         f"/api/v1/bookings/{booking['public_ref']}/checkout",
         json={