feat(platform): add resource update safeguards

backend/api/internal/logic/platform/resource_test.go

@@ -1,6 +1,9 @@
 package platform
 
-import "testing"
+import (
+	"net/http"
+	"testing"
+)
 
 func TestExpectedResources(t *testing.T) {
 	assertContract(t, ExpectedResources(), "gas", "gas_basic", Writable, "list")
@@ -8,6 +11,32 @@ func TestExpectedResources(t *testing.T) {
 	assertContract(t, ExpectedResources(), "wallet", "wallet_ledger", ReadOnly, "list")
 }
 
+func TestResourceDefinitionAllowsOnlySupportedMethods(t *testing.T) {
+	if (ResourceDefinition{Mode: ReadOnly}).Allows(http.MethodPost) {
+		t.Fatal("readonly allows POST")
+	}
+	if !(ResourceDefinition{Mode: AppendOnly}).Allows(http.MethodPost) {
+		t.Fatal("append-only rejects POST")
+	}
+	if (ResourceDefinition{Mode: AppendOnly}).Allows(http.MethodDelete) {
+		t.Fatal("append-only allows DELETE")
+	}
+}
+
+func TestArchiveValuesOnlyArchives(t *testing.T) {
+	got := archiveValues()
+	if len(got) != 1 || got["status"] != "archived" {
+		t.Fatalf("unexpected archive values: %#v", got)
+	}
+}
+
+func TestFilterFieldsKeepsOnlyAllowedKeys(t *testing.T) {
+	got := filterFields(map[string]any{"name": "n", "password_hash": "x"}, []string{"name"})
+	if len(got) != 1 || got["name"] != "n" {
+		t.Fatalf("unexpected filtered fields: %#v", got)
+	}
+}
+
 func assertContract(t *testing.T, contracts []ResourceContract, domain, name string, mode ResourceMode, pageKind string) {
 	t.Helper()
 	for _, contract := range contracts {