Fixes TC-TD-09 (product_id required → 400 not 201), TC-NS-08
(check_one_of for 200/404), TC-RO-10 (use TASK_ID directly to avoid
cross-story scope violation). Adds DEMO_TOKEN support for 403 tests
on all 4 write endpoints. Adds check_one_of helper and shorthand
request functions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
