Test/add seed to test voting

.claude/skills/backend-api-explore/SKILL.md

@@ -228,10 +228,10 @@ row-count overview.
   2. **Is it capability-gated, and is that capability on _in this hackathon_?**
      `SetPreference`, `RemovePreference`, `Propose` and the submission RPCs are
      gated on a capability, which is really a casbin row written alongside a
-     `HackathonState` boolean. `cmd/seed` writes both (`seedCapabilities`) with
-     a **different set per hackathon**, so the same call succeeds in one seeded
-     hackathon and is refused in the next — configuration, not a bug. Read the
-     set instead of guessing:
+     `HackathonState` boolean. `cmd/seed` sets both through `SetCapabilities`
+     with a **different set per hackathon**, so the same call succeeds in one
+     seeded hackathon and is refused in the next — configuration, not a bug.
+     Read the set instead of guessing:
      ```
      just rpc::as alice aliceandbob hackathon.HackathonService/Get \
        '{"hackathonId":"<uuid>"}' | jq '.hackathon.state'

.claude/skills/backend-service-dev/SKILL.md

@@ -170,12 +170,11 @@ auto-enable or disable any capability."_ `SetCurrentPhase` sets
 and never touches state or casbin. Advancing a phase changes what the UI
 displays, not what anyone may do.
 
-**`cmd/seed` writes both halves itself.** `seedCapabilities`
-(`cmd/seed/main.go:67`) creates each hackathon's `HackathonState` row _and_ the
-casbin rows that go with it, copying the role each capability grants to from
-`SetCapabilities` — plus one row `SetCapabilities` does not write: team
-preferences to `Owner` as well as `Member`, so the fixture shows the intended
-behaviour ahead of the handler (see
+**`cmd/seed` goes through the handler.** It drives the real server in-process
+and sets each hackathon's capabilities with `SetCapabilities` (`setCaps` in
+`cmd/seed/steps.go`), so seeded state and casbin rows are exactly what the API
+writes — including the gap that an owner holding no `Member` row cannot set a
+team preference (see
 `mydocs/docs/backend-tickets/project-preferences-capability.md`). The set
 differs per hackathon, so a `PermissionDenied` in seeded data means that
 capability is off in _that_ hackathon — read `state` from `HackathonService.Get`

CLAUDE.md

@@ -144,11 +144,11 @@ These hold across the whole codebase; the skills explain the mechanisms.
   of surprising `PermissionDenied`.
 - **A phase does not control what participants may do.** `Phase.capabilities` is
   informational; `HackathonState` plus its casbin rows is what actually gates
-  anything, and `SetCurrentPhase` does not touch either. `cmd/seed` writes both
-  halves (`seedCapabilities`) with a **different capability set per hackathon**,
-  so a refused mutation in seeded data means that capability is off _there_ —
-  not that the fixture is unusable. Details in **backend-service-dev**;
-  diagnosis in **backend-api-explore**.
+  anything, and `SetCurrentPhase` does not touch either. `cmd/seed` sets both
+  halves through `SetCapabilities` with a **different capability set per
+  hackathon**, so a refused mutation in seeded data means that capability is off
+  _there_ — not that the fixture is unusable. Details in
+  **backend-service-dev**; diagnosis in **backend-api-explore**.
 - **Don't trust written status.** Determine what's implemented by asking the
   running server — see **backend-api-explore**. Any inventory committed to a
   markdown file is a snapshot that starts rotting immediately, this one

components/backend/cmd/seed/h3.go

@@ -243,6 +243,8 @@ func (h *harness) seedH3(now time.Time, admin, alice, dana *actor) error {
 		description: "Vote for the project you found most interesting or useful.",
 		method:      voteEnts.VotingMethod_VOTING_METHOD_SINGLE_CHOICE,
 		voterType:   voteEnts.VoterType_VOTER_TYPE_ALL_PARTICIPANTS,
+		maxPoints:   0,
+		jury:        nil,
 	})
 	if err != nil {
 		return err
@@ -279,8 +281,9 @@ func (h *harness) seedH3(now time.Time, admin, alice, dana *actor) error {
 	}
 
 	// Over a month past: nothing left to do but look at what happened. Voting
-	// stays on with the results, which is how the fixture used to read; what
-	// actually stops a late vote now is the sprint being over.
+	// stays on with the results, which is how the fixture used to read. Nothing
+	// else stops a late vote either — SubmitVote does not look at the dates — so
+	// alice can still change hers. H6 is the hackathon for testing voting itself.
 	if err := h.setCaps(admin, id,
 		hackEnts.Capability_CAPABILITY_VOTE,
 		hackEnts.Capability_CAPABILITY_VIEW_RESULTS,