First deposit integration slice

scripts/monero-mtls-stagenet-rehearsal.mjs

@@ -127,6 +127,10 @@ try {
   const sub=await gatewayCall(validTransport,'create_address',{account_index:0,label:`wikideck-deposit-v1:${randomUUID()}`,count:1});
   console.log('stage: authorized mTLS subaddress creation');
   assert.equal(sub.status,200); assert.equal(sub.data.result.address_index,1);
+  const outputs=await gatewayCall(validTransport,'incoming_transfers',{transfer_type:'all',account_index:0,subaddr_indices:[1]});
+  assert.equal(outputs.status,200); assert.deepEqual(outputs.data.result.transfers,[],
+    'a fresh watch-only Stagenet address must return an empty owned-output list');
+  console.log('stage: authorized bounded incoming-output read');
   const forbiddenStatus=await rawGatewayStatus('transfer',{destinations:[]},certs['client.crt'],certs['client.key'],certs['ca.crt']);
   assert.equal(forbiddenStatus,400,'gateway must reject transfer before Wallet RPC');
   console.log('stage: forbidden transfer blocked');
@@ -141,7 +145,7 @@ try {
   passed=true;
   console.log(JSON.stringify({result:'passed',moneroWalletRpc:'0.18.5.4',network:'Stagenet',containerNetwork:'none',
     rpcAuthentication:'mTLS',tlsMinimum:'1.3',approvedClientAccepted:true,untrustedClientRejected:true,
-    noCertificateRejected:true,forbiddenTransferRejected:true,allowedAddressCreation:true,watchOnly:true,
+    noCertificateRejected:true,forbiddenTransferRejected:true,allowedAddressCreation:true,allowedOutputRead:true,watchOnly:true,
     realFundsUsed:false,secretsOrAddressesLogged:false}));
 } finally {
   if(gateway) await new Promise(resolveClose=>gateway.close(()=>resolveClose()));