fix #557: guide permission-driven VPD flow

src/test/java/com/cloudhandson/vpdbackoffice/web/GuidedFlowTemplateTest.java

@@ -0,0 +1,55 @@
+package com.cloudhandson.vpdbackoffice.web;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.Test;
+
+class GuidedFlowTemplateTest {
+
+  @Test
+  void dashboardExplainsTheFourStepPermissionJourney() throws IOException {
+    String html = template("dashboard.html");
+
+    assertThat(html)
+        .contains("1. 권한 설계")
+        .contains("2. DB 보호 연결")
+        .contains("3. 토큰 발급")
+        .contains("4. 결과 확인");
+  }
+
+  @Test
+  void probeUsesOneTokenInputAndHidesTechnicalExchangeByDefault() throws IOException {
+    String probe = template("probe.html");
+    String result = template("fragments/probe-result.html");
+
+    assertThat(probe).contains("name=\"bearerToken\"").doesNotContain("name=\"tokenKeyId\"");
+    assertThat(result)
+        .contains("적용된 사용자와 권한")
+        .contains("다음에 할 일")
+        .contains("<details")
+        .contains("기술 상세");
+  }
+
+  @Test
+  void vpdDefaultApplyAndAdvancedCustomFiltersAreVisuallySeparated() throws IOException {
+    String policies = template("vpd-policies.html");
+    String filters = template("vpd-filter-policies.html");
+
+    assertThat(policies)
+        .contains("action=\"/vpd-policies/default\"")
+        .contains("권한체계 자동 적용")
+        .contains("객체만 선택");
+    assertThat(filters)
+        .contains("기본 동작: 권한체계 자동 반영")
+        .contains("고급: 별도 Filter 만들기")
+        .contains("fail-closed")
+        .contains("CB_AGENT_DOC_VPD_FILTER");
+  }
+
+  private String template(String relativePath) throws IOException {
+    return Files.readString(Path.of("src/main/resources/templates").resolve(relativePath));
+  }
+}