Test enrollment

GET /portal/enrollment returns only the authenticated identity’s original enrollment receipt and whether it may create a workspace. POST /portal/enrollment accepts display_name and business_type (INDIVIDUAL_TRADER, COMPANY, NGO, or PUBLIC_BODY) with an Idempotency-Key. The short-lived merchant audience token must carry verified email and MFA. The browser uses the authenticated BFF and CSRF protection; it never sends a chosen owner or permissions.

The local service atomically creates a generated merchant ID, test environment, initial Owner membership and audit record. The receipt explicitly reports environment: test, kyb_state: NOT_STARTED and phone_verified: false. These are enrollment-time facts, not a current KYB status API. Use the refreshed portal session for current memberships and permissions.

The sandbox permits one self-created workspace per identity, and creation is unavailable while that identity already has an active merchant membership. An exact normalized retry returns the original receipt. Another body under the same key conflicts; another key cannot create a second workspace. Revocation or merchant disabling prevents replay from restoring access. Existing invitations remain available to users who have not enrolled.

This increment implements business-type selection and immediate test access under the existing local SSO identity. It does not implement real email/phone verification or recovery, KYB, settlement verification or live activation. Fixture email verification is synthetic. Production sign-up and abuse controls require an approved identity/contact-verification provider and policy.