$ java Acceptance.java http://127.0.0.1:6141
PASS  TC-3.1       price list is public: 12 services, S0001 8000, S0005 65000
PASS  TC-1.5       no session: GET /api/bills -> 401 not_logged_in
PASS  TC-1.2/1.3   wrong password and unknown e-mail: same status, same body
PASS  TC-1.1       owner logs in: role owner, outlet O01 (login and /api/me)
PASS  TC-1.8       session cookie is HttpOnly and SameSite=Lax
PASS  TC-11.2      O03 queued: total 5, first B2940 with balance 18000
PASS  TC-11.6      per_page=1000 is capped at 100
PASS  TC-11.7      B2938: payment is the number 40000, times are plain text
PASS  TC-8.1       dashboard 2026-09-30: O01 6/186000/9/0/23, O02 1/0/9/6/6, O03 3/160000/5/0/5
PASS  TC-9.1       monthly: 2025-10 = 171 / 8362000 / 7686000, year = 2953 / 144213000 / 142684000
PASS  TC-11.3      POST without X-CSRF-Token -> 403 csrf_failed, nothing saved
PASS  TC-9.7       a cashier asking for a report -> 403
PASS  TC-10.1      status B2938 + phone with spaces: Ready for pickup, still to pay 40000
PASS  TC-10.3/10.4 wrong phone and unknown bill: same 404, same body
PASS  TC-10.5      the status answer names no customer
PASS  TC-NF-02     SQL injection text in status and login -> 404 / 401, no 500
PASS  TC-1.7       after logout the same cookie gets 401
PASS  TC-11.5      none of 21 responses has a password field or hash

18 of 18 acceptance checks passed against http://127.0.0.1:6141
(exit code 0)
