fix(auth): complete Task 13 deployment review

tools/tht/internal/pi/update_test.go

@@ -779,6 +779,39 @@ func TestUpdateRequiresConfirmationAndDrainsActiveSessions(t *testing.T) {
 	assertCalled(t, fake.calls, "/internal/maintenance/deactivate")
 }
 
+func TestMaintenanceControlUsesExactLoopbackOperatorIdentity(t *testing.T) {
+	fake := newFakeRunner()
+	if err := setMaintenance(context.Background(), fake, true); err != nil {
+		t.Fatal(err)
+	}
+	fake.maintenance = true
+	if _, err := MaintenanceStatus(context.Background(), fake); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{"/internal/maintenance/activate", "/internal/maintenance/status"} {
+		found := false
+		for _, call := range fake.calls {
+			if !strings.Contains(call, path) {
+				continue
+			}
+			found = true
+			for _, header := range []string{
+				"x-thoth-principal-issuer: tht",
+				"x-thoth-principal-subject: tht-maintenance",
+				"x-thoth-principal-display-name: Tht maintenance",
+				"x-thoth-is-admin: 1",
+			} {
+				if !strings.Contains(call, header) {
+					t.Fatalf("maintenance call %q lacks %q", call, header)
+				}
+			}
+		}
+		if !found {
+			t.Fatalf("maintenance call %q was not made", path)
+		}
+	}
+}
+
 func TestRollbackRestoresInterruptedOrPreviouslyRecordedState(t *testing.T) {
 	fake := newFakeRunner()
 	statePath := filepath.Join(t.TempDir(), "state.json")