perf(tests): isolate network E2E and await QUIC cleanup

backend/tests/MoShiro.Backend.Tests/AgentLimitsTests.cs

@@ -0,0 +1,31 @@
+using System.Text.Json.Nodes;
+
+namespace MoShiro.Backend.Tests;
+
+/// <summary>Agent local policy validation has its own Backend fixture so task overrides from line-session tests cannot leak into it.</summary>
+[Trait("Category", "Slow")]
+public sealed class AgentLimitsTests : IClassFixture<BackendFixture>
+{
+    private readonly BackendFixture _backend;
+
+    public AgentLimitsTests(BackendFixture backend)
+    {
+        _backend = backend;
+    }
+
+    private async Task<JsonNode> AgentViewAsync(AgentHarness agent) => await _backend.GetJsonAsync(_backend.Admin, "/api/admin/agents/" + agent.Id);
+
+    [Fact]
+    public async Task LocalLimits_RejectTasksOutsideTheAllowedPorts_AndTheReasonReachesTheAdmin()
+    {
+        // The default task ports (7443/7444) do not match this Agent's actual listeners, so policy rejects them.
+        await using AgentHarness agent = await AgentHarness.StartAsync(_backend);
+        await BackendFixture.EventuallyAsync(async () => (await AgentViewAsync(agent))["rejected"]!.AsArray().Count == Defaults.TaskCount);
+        JsonNode rejected = (await AgentViewAsync(agent))["rejected"]!;
+        Assert.All(rejected.AsArray(), item => Assert.Equal("policy_denied", item!["reason"]!.GetValue<string>()));
+
+        // Override the task ports to match the actual listeners and verify recovery.
+        await agent.OverrideLineTasksAsync();
+        await BackendFixture.EventuallyAsync(async () => (await AgentViewAsync(agent))["rejected"]!.AsArray().Count == 0);
+    }
+}