Feat v0.9.1 server side subpath routing (#74)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/pages/pages_surface_match_test.go

@@ -168,6 +168,57 @@ func TestFindNavSurface_NoMatch(t *testing.T) {
 	}
 }
 
+// ── aggregateAccess tests ──────────────────────────────────
+
+func TestAggregateAccess_AllPublic(t *testing.T) {
+	surfaces := []any{
+		map[string]any{"path": "/", "access": "public"},
+		map[string]any{"path": "/submit", "access": "public"},
+	}
+	if got := aggregateAccess(surfaces); got != "public" {
+		t.Errorf("expected public, got %s", got)
+	}
+}
+
+func TestAggregateAccess_AllAuthenticated(t *testing.T) {
+	surfaces := []any{
+		map[string]any{"path": "/", "access": "authenticated"},
+		map[string]any{"path": "/admin", "access": "admin"},
+	}
+	if got := aggregateAccess(surfaces); got != "authenticated" {
+		t.Errorf("expected authenticated, got %s", got)
+	}
+}
+
+func TestAggregateAccess_Mixed(t *testing.T) {
+	surfaces := []any{
+		map[string]any{"path": "/submit", "access": "public"},
+		map[string]any{"path": "/dashboard", "access": "authenticated"},
+	}
+	if got := aggregateAccess(surfaces); got != "mixed" {
+		t.Errorf("expected mixed, got %s", got)
+	}
+}
+
+func TestAggregateAccess_DefaultAccess(t *testing.T) {
+	// No access field → defaults to "authenticated"
+	surfaces := []any{
+		map[string]any{"path": "/"},
+	}
+	if got := aggregateAccess(surfaces); got != "authenticated" {
+		t.Errorf("expected authenticated (default), got %s", got)
+	}
+}
+
+func TestAggregateAccess_SinglePublic(t *testing.T) {
+	surfaces := []any{
+		map[string]any{"path": "/", "access": "public"},
+	}
+	if got := aggregateAccess(surfaces); got != "public" {
+		t.Errorf("expected public, got %s", got)
+	}
+}
+
 // ── evaluateAccess tests ────────────────────────────────────
 // Note: evaluateAccess depends on gin.Context which is hard to unit test
 // without a full Gin setup. These are covered via handler integration tests.