fix(GRO-1272): address QA review items for rbac.test.ts

- Rename insertedStaff to _insertedStaff (ESLint unused var, line 49)
- Rename table param to _table in insert mock (ESLint unused param, line 91)
- Fix buildApp jwtPayload to prefer userLookupResult.id over staffLookupResult.userId
  (corrects auto-provision test failures where sub was 'unknown-sub' instead of 'ba-user-new')

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/api/src/__tests__/rbac.test.ts

@@ -46,7 +46,7 @@ const GROOMER: StaffRow = {
 let staffLookupResult: StaffRow | null = null;
 let managerFallbackResult: StaffRow | null = MANAGER;
 let userLookupResult: { id: string; name: string | null; email: string | null } | null = null;
-let insertedStaff: StaffRow | null = null;
+let _insertedStaff: StaffRow | null = null;
 
 vi.mock("../db", () => {
   const makeTableProxy = (name: string) =>
@@ -88,7 +88,7 @@ vi.mock("../db", () => {
           ),
         }),
       }),
-      insert: (table: unknown) => ({
+      insert: (_table: unknown) => ({
         values: (vals: Record<string, unknown>) => ({
           returning: () => {
             const newStaff: StaffRow = {
@@ -104,7 +104,7 @@ vi.mock("../db", () => {
               createdAt: new Date(),
               updatedAt: new Date(),
             };
-            insertedStaff = newStaff;
+            _insertedStaff = newStaff;
             return [newStaff];
           },
         }),
@@ -124,7 +124,7 @@ function resetMocks() {
   staffLookupResult = null;
   managerFallbackResult = MANAGER;
   userLookupResult = null;
-  insertedStaff = null;
+  _insertedStaff = null;
 }
 
 /** Build a minimal Hono app with jwtPayload pre-set, then apply a middleware. */
@@ -134,7 +134,7 @@ function buildApp(
 ) {
   const app = new Hono<AppEnv>();
   app.use("*", async (c, next) => {
-    c.set("jwtPayload", { sub: staffLookupResult?.userId ?? "unknown-sub" });
+    c.set("jwtPayload", { sub: userLookupResult?.id ?? staffLookupResult?.userId ?? "unknown-sub" });
     await next();
   });
   app.use("*", middleware);