SAMPLE EVIDENCE for AR-02 (made-up app Tidyhaus; not a real review)

Sent as: user B (test account)
POST https://staging.tidyhaus.example/functions/v1/admin-refund
Authorization: Bearer [token redacted]

Response: HTTP 403
{"error":"admin only"}