fix(auth): enforce password and agent role boundaries

tests/Feature/AdminPlatformRoleBoundaryTest.php

@@ -150,15 +150,51 @@ test('agent creation keeps its agent role and cleanup removes only unbound platf
         'granted_at' => now(),
     ]);
 
-    expect(InvalidPlatformAgentRoleCleanup::run())->toBe(1);
+    $otherSiteId = (int) DB::table('admin_sites')->insertGetId([
+        'code' => 'boundary-other-site',
+        'name' => 'Boundary Other Site',
+        'is_default' => false,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+    DB::table('admin_user_site_roles')->insert([
+        'admin_user_id' => $agentUser->id,
+        'site_id' => $otherSiteId,
+        'role_id' => $agentRole->id,
+        'granted_at' => now(),
+    ]);
+    $ordinaryRole = AdminRole::query()->create([
+        'slug' => 'cross_site_ordinary_role',
+        'name' => 'Cross Site Ordinary Role',
+        'scope_type' => AdminRole::SCOPE_SYSTEM,
+    ]);
+    DB::table('admin_user_site_roles')->insert([
+        'admin_user_id' => $agentUser->id,
+        'site_id' => $otherSiteId,
+        'role_id' => $ordinaryRole->id,
+        'granted_at' => now(),
+    ]);
+
+    expect(InvalidPlatformAgentRoleCleanup::run())->toBe(2);
     expect(DB::table('admin_user_site_roles')
         ->where('admin_user_id', $illegalUser->id)
         ->where('role_id', $agentRole->id)
         ->exists())->toBeFalse();
     expect(DB::table('admin_user_site_roles')
         ->where('admin_user_id', $agentUser->id)
+        ->where('site_id', $siteId)
         ->where('role_id', $agentRole->id)
         ->exists())->toBeTrue();
+    expect(DB::table('admin_user_site_roles')
+        ->where('admin_user_id', $agentUser->id)
+        ->where('site_id', $otherSiteId)
+        ->where('role_id', $agentRole->id)
+        ->exists())->toBeFalse();
+    expect(DB::table('admin_user_site_roles')
+        ->where('admin_user_id', $agentUser->id)
+        ->where('site_id', $otherSiteId)
+        ->where('role_id', $ordinaryRole->id)
+        ->exists())->toBeTrue();
     expect(AdminUser::query()->whereKey($illegalUser->id)->exists())->toBeTrue();
 });