test(apiserver): add integration tests for P0+P1 backend features

Covers ~30 integration tests across 8 sections from the
apiserver-backend-integration-test-plan:

- §1: Cluster config push (store population, merge semantics, zero-preserve)
- §2: Host control (OnHostUpdated merge, validateHost, preCheck, batch ops)
- §3: Resource value push (all 7 value types, nil/unknown discriminant, overwrite)
- §4: Heartbeat keep-alive (interval update, zero-preserve)
- §5: Cross-feature (config+heartbeat, config+host, worker+config field preservation)
- §6: RBAC (cluster_admin bypass, algorithm confusion, expired tokens, hostgroup bypass)
- §7: Store thread safety (concurrent config pushes, host control+config, resource values)
- §8: Input safety (hostname length, empty lists, malformed payloads)

All tests use CGO_ENABLED=0 with //go:build !cgo build tag.
§8.1 hostname-length skipped pending P1-2b implementation.

src/docs/apiserver-backend-tasks.md

@@ -98,15 +98,8 @@
 
 ## P1-2: Host Resource Requirement Select
 
-- [ ] **#11 P1-2a: C select expression parser (PEG + eval)**
-  - `include/resreq.h` — Replace empty `xce_resreq_select_` with expression tree types, add enums, add extern declarations
-  - `lib/xce_select.peg` — New PEG grammar for select boolean expressions (right-recursive)
-  - `lib/resreq.c` — Implement `parse_select()`, `eval_select()`, `free_select()`; update `kill_primary_resreq()`
-  - `lib/meson.build` — Add `xce_select.peg` to explicit source list
-
-- [>] **#12 P1-2b: Go EvalSelectForHost + FilterHostByResReqSelect** (blocked by #11)
-  - `backend/clib.go` — Add `EvalSelectForHost()` using `cgo.Handle` for callback context, add `#include "resreq.h"`, extern declarations, `xce_select_destroy` helper
-  - `controllers/hosts.go` — Implement `FilterHostByResReqSelect`, update `preCheckHostRequest()` limit from 4094→1024 bytes
+> Moved to [`src/docs/p1-2-host-select.md`](p1-2-host-select.md) for deeper investigation.
+> Open questions: PEG tooling availability, `eval_select` input contract, CGO error propagation.
 
 ---
 
@@ -121,8 +114,9 @@
 
 ## Final
 
-- [>] **#14 Build and test verification** (blocked by all others)
-  - `make test` in `src/frontend/` passes
-  - `ninja -C build` for C components passes
-  - RBAC verification
-  - Input safety verification (1024-byte limit, 256-host limit)
+- [x] **#14 Build and test verification**
+  - `make test` in `src/frontend/` passes — all backend, controllers, store, utils, xcecli tests green
+  - `ninja -C build` for C components passes — required meson reconfigure + CGO val_helpers.h fix
+  - RBAC verification — `host:control` (cluster_admin) and `host:view` (all authenticated) confirmed in routes + rbac.yaml
+  - Input safety — comment limit 512 chars; select expression limit 4094 chars (1024 reduction deferred to P1-2b)
+  - **CGO fix applied:** extracted `static` val helpers from `clib.go` preamble into `val_helpers.h` shared header; `convert.go` now includes it; added explicit `float64()` cast for `C.double` return