p2.6: warn when permit_restricted has no key

CheckMappings now logs WARN for each permit_restricted name missing
from keys.toml, so a missing straylight-gs key is visible at start
and on reload instead of passing silently.

internal/fleetctx/fleetctx_test.go

@@ -1,11 +1,14 @@
 package fleetctx
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
@@ -184,3 +187,19 @@ func TestConcurrentSearch(t *testing.T) {
 		t.Fatalf("calls %d", c.Calls.Load())
 	}
 }
+
+func TestCheckMappingsWarnsMissingKey(t *testing.T) {
+	var buf bytes.Buffer
+	log := slog.New(slog.NewTextHandler(&buf, nil))
+	c := &Client{Permit: []string{"straylight-gs"}, Log: log}
+	c.CheckMappings(nil)
+	got := buf.String()
+	if !strings.Contains(got, "permit_restricted caller has no key") || !strings.Contains(got, "straylight-gs") {
+		t.Fatalf("missing warn: %s", got)
+	}
+	buf.Reset()
+	c.CheckMappings([]CallerWS{{Name: "straylight-gs", Workspace: "guardian-star"}})
+	if strings.Contains(buf.String(), "no key") || strings.Contains(buf.String(), "mapped off") {
+		t.Fatalf("mapped ok still logged: %s", buf.String())
+	}
+}