test(busylight): Pull-Token deaktivierter Firma liefert 401

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

backend/tests/test_busylight.py

@@ -225,3 +225,17 @@ async def test_delete_token_invalidates_pull(client: AsyncClient, bl_headers):
         headers={"Authorization": f"Bearer {fresh}"},
     )
     assert pull_after.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_pull_rejected_for_inactive_company(client: AsyncClient, other_company_token, db_session):
+    from sqlalchemy import text
+    await db_session.execute(text("SET LOCAL app.bypass_rls = 'on'"))
+    await db_session.execute(text("UPDATE companies SET is_active = false WHERE name = 'Other GmbH'"))
+    await db_session.commit()
+
+    resp = await client.get(
+        "/api/v1/busylight/users",
+        headers={"Authorization": f"Bearer {other_company_token}"},
+    )
+    assert resp.status_code == 401