== Slug ==
  OK   accepts acme
  OK   accepts 16 chars
  OK   rejects 17 chars (MySQL 32-char user limit)
  OK   rejects 2 chars
  OK   rejects uppercase
  OK   rejects hyphen / underscore / dot
  OK   rejects reserved (admin, www, master)
  OK   user name for a max slug fits in 32 chars
  OK   host -> slug
  OK   host with port
  OK   host uppercase + trailing dot
  OK   bare base domain -> null
  OK   nested label -> null
  OK   other domain -> null
  OK   look-alike suffix -> null
  OK   reserved label -> null
  OK   empty host -> null
== CredentialVault ==
  OK   round-trip
  OK   blob length = 29 bytes overhead + plaintext length
  OK   two encryptions of the same value differ (random IV)
  OK   tampered ciphertext is rejected
  OK   wrong key is rejected
  OK   truncated blob is rejected
  OK   bad key format is rejected
== SqlSplitter ==
  OK   3 statements, semicolons inside strings/comments/backticks ignored
  OK   doubled quote kept intact
  OK   empty / whitespace-only input -> no statements
== Billing dates ==
  OK   Jan 31 + 1 month = Feb 28 (clamped)
  OK   Jan 31 + 1 month in a leap year = Feb 29
  OK   Dec 15 + 1 month rolls the year
  OK   Jan 31 + 13 months
  OK   monthly chain from Jan 31 does NOT drift (28, 31, 30, 31)
  OK   yearly chain from Feb 29 clamps then recovers (2025-02-28, 2026-02-28, 2027-02-28)
== License expiry rules ==
  OK   active + 5 grace days
  OK   past_due still gets the same paid-through + grace
  OK   customer-cancelled subscription: paid-through, NO grace
  OK   suspended tenant -> yesterday regardless of payment
  OK   cancelled/failed tenant -> yesterday
  OK   no subscription -> leave unchanged (null)
  OK   provisioning tenant is treated like active

UNIT RESULT: 40 passed, 0 failed