Add guided Payments operator workspace

tests/test_payments.py

@@ -21,6 +21,7 @@ from govoplan_payments.backend.service import (
     PaymentError,
     SqlPaymentRequestProvider,
 )
+from govoplan_payments.backend.manifest import manifest
 
 
 NOW = datetime(2026, 8, 19, 10, 0, tzinfo=UTC)
@@ -199,6 +200,19 @@ class PaymentTests(unittest.TestCase):
         self.assertEqual(1, len(requested))
         self.assertEqual((), self.provider.list_payments(self.session, tenant_id="tenant-2"))
 
+    def test_manifest_exposes_permission_bounded_operator_workspace(self) -> None:
+        self.assertEqual("0.1.20", manifest.version)
+        self.assertIsNotNone(manifest.frontend)
+        assert manifest.frontend is not None
+        self.assertEqual("@govoplan/payments-webui", manifest.frontend.package_name)
+        self.assertEqual("/payments", manifest.frontend.routes[0].path)
+        self.assertEqual(("payments:payment:read",), manifest.frontend.routes[0].required_any)
+        self.assertEqual("payments.workspace", manifest.frontend.routes[0].surface_id)
+        self.assertEqual("payments.navigation", manifest.frontend.nav_items[0].surface_id)
+        surface_ids = {surface.id for surface in manifest.frontend.view_surfaces}
+        self.assertIn("payments.request.create", surface_ids)
+        self.assertIn("payments.reconciliation.manual", surface_ids)
+
 
 if __name__ == "__main__":
     unittest.main()