Addresses @sara blocker: RelationshipControllerTest now has 6 tests covering the two previously untested @RequirePermission(WRITE_ALL) endpoints. Prevents silent permission regression if the controller is refactored. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>