Add development guidelines, testing rules, and secure routes documentation

- Add `.junie/guidelines.md` with comprehensive development instructions.
- Include `.aiassistant/rules/Creating and maintaining tests.md` and `.aiassistant/rules/Creating and securing routes.md`.
- Introduce `CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES` for lane service validation.
- Update `selfserve_lane_relay_controller_t` to enforce service-specific permissions for machine relay.

openapi.yaml

@@ -2756,6 +2756,11 @@ paths:
                 order_priority:
                   type: integer
                   default: 0
+                services:
+                  type: array
+                  description: Optional services enabled by this task. Items must be valid service enum names.
+                  items:
+                    $ref: '#/components/schemas/SelfserveLaneService'
       responses:
         '200':
           description: Successfully added task
@@ -2802,6 +2807,12 @@ paths:
                   type: string
                 order_priority:
                   type: integer
+                services:
+                  type: array
+                  nullable: true
+                  description: Services enabled by this task. Set to null to clear all services.
+                  items:
+                    $ref: '#/components/schemas/SelfserveLaneService'
       responses:
         '200':
           description: Successfully updated task
@@ -5060,6 +5071,101 @@ paths:
               schema:
                 $ref: '#/components/schemas/SelfServeLaneStatus'
 
+  /modules/self-serve/lane/services/allowed:
+    post:
+      tags:
+        - Modules
+      summary: Set allowed services for a lane based on shown tasks
+      description: |
+        Updates the set of services that are allowed to be manually activated for a given self-serve lane,
+        derived from the tasks currently shown to the user after answering the self-serve questions.
+        This endpoint does not activate anything by itself; it only sets what is allowed to be activated.
+      operationId: setSelfServeLaneAllowedServices
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - lane_id
+              properties:
+                lane_id:
+                  type: integer
+                task_ids:
+                  type: array
+                  description: List of task IDs that are currently shown to the user
+                  items:
+                    type: integer
+      responses:
+        '200':
+          description: Allowed services updated
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  lane_id:
+                    type: integer
+                  allowed_services:
+                    type: array
+                    items:
+                      type: string
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+
+  /modules/self-serve/lane/relay/machine/enable:
+    post:
+      tags:
+        - Modules
+      summary: Manually enable MACHINE relay for a lane
+      description: |
+        Manually turns on the MACHINE relay for a self-serve lane if and only if the current allowed services
+        include `MACHINE` (set via `/modules/self-serve/lane/services/allowed`). The relay is never automatically
+        enabled; an explicit call to this endpoint is required.
+      operationId: enableSelfServeLaneMachineRelay
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - lane_id
+              properties:
+                lane_id:
+                  type: integer
+                duration:
+                  type: integer
+                  description: Optional number of seconds after which the relay should automatically turn off
+      responses:
+        '200':
+          description: MACHINE relay enabled
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  lane_id:
+                    type: integer
+                  relay:
+                    type: string
+                  enabled:
+                    type: boolean
+                  duration:
+                    type: integer
+                    nullable: true
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          description: Not allowed to enable MACHINE relay (no matching task currently shown)
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+
   # Module - Other Integration Endpoints
   /modules/motorapi/lookup:
     get:
@@ -6609,6 +6715,12 @@ components:
           type: integer
           description: The product ID used for minute-based billing
 
+    SelfserveLaneService:
+      type: string
+      description: Allowed self-serve lane service name
+      enum:
+        - MACHINE
+
     DepartmentSelfserveQuestion:
       type: object
       properties:
@@ -6672,6 +6784,12 @@ components:
         order_priority:
           type: integer
           description: Display order priority (lower numbers shown first)
+        services:
+          type: array
+          description: Services enabled by this task. Each item must be a valid service enum name.
+          items:
+            $ref: '#/components/schemas/SelfserveLaneService'
+          default: []
         created_at:
           type: string
           format: date-time