Expand scoped demo analysis access

backend/tests/test_auth.py

@@ -126,7 +126,7 @@ def test_login_uses_http_only_session_cookie_and_logout_revokes_browser_access(m
     assert protected_after_logout.status_code == 401
 
 
-def test_guest_login_seeds_scoped_demo_and_rejects_mutating_or_cross_project_requests(monkeypatch) -> None:
+def test_guest_login_exposes_models_but_rejects_management_and_cross_project_requests(monkeypatch) -> None:
     project_id = UUID("00000000-0000-0000-0000-000000000123")
     demo = DemoWorkflowResponse(
         project_id=project_id,
@@ -152,7 +152,11 @@ def test_guest_login_seeds_scoped_demo_and_rejects_mutating_or_cross_project_req
     guest_session = client.get("/api/v1/auth/session")
     mutation = client.post("/api/v1/projects", json={"name": "Not allowed"})
     other_project = client.get("/api/v1/projects/00000000-0000-0000-0000-000000000999")
-    unscoped_read = client.get("/api/v1/detection/models")
+    detection_models = client.get("/api/v1/detection/models")
+    segmentation_models = client.get("/api/v1/segmentation/models")
+    cross_project_runs = client.get(
+        "/api/v1/detection/runs?project_id=00000000-0000-0000-0000-000000000999"
+    )
     cross_project_coverage = client.post(
         "/api/v1/external/coverage/resolve",
         json={
@@ -172,8 +176,11 @@ def test_guest_login_seeds_scoped_demo_and_rejects_mutating_or_cross_project_req
     assert mutation.json()["error"] == "GUEST_READ_ONLY"
     assert other_project.status_code == 403
     assert other_project.json()["error"] == "GUEST_PROJECT_SCOPE_REQUIRED"
-    assert unscoped_read.status_code == 403
-    assert unscoped_read.json()["error"] == "GUEST_ROUTE_NOT_AVAILABLE"
+    assert detection_models.status_code == 200
+    assert detection_models.json()["data"]["models"]
+    assert segmentation_models.status_code == 200
+    assert cross_project_runs.status_code == 403
+    assert cross_project_runs.json()["error"] == "GUEST_PROJECT_SCOPE_REQUIRED"
     assert cross_project_coverage.status_code == 403
     assert cross_project_coverage.json()["error"] == "GUEST_PROJECT_SCOPE_REQUIRED"