test

    std::cerr << "created service client '" << serviceClientName << "' (id=" << clientId << ")"

              << std::endl;

    // GPOadd/addGroup/listGroups/existsGPO are all gated server-side on a client-connection

    // session (see authdb/src/api.cpp's "if (curcon)" block), which is separate from the user

    // session UserAuth() established above. Without this, those calls silently no-op server-side

    // (curcon stays null, their handlers never run) and every one fails with a generic

    // "no id returned" -- there's no error to surface because nothing ran at all.

    con.setClientName(serviceClientName);

    con.setClientSecret(serviceClientSecret);

    if (!admin.ClientAuth()) {

        std::cerr << "ClientAuth failed for service client '" << serviceClientName << "'" << std::endl;

        return 1;

    }

    // Create the standard-role groups (idempotent: addGroup's id-match fast-path in

    // authdb's api.cpp returns success if a group with this id already exists).

    for (const auto &g : kGroups) {