Route TUI controls through polkit

tests/test_tui.py

@@ -595,6 +595,22 @@ class TestDisclosuresAndGreeting:
 # ---------------------------------------------------------------------------
 
 class TestFirstRun:
+    def test_unprivileged_resume_uses_polkit(self, tmp_path):
+        """TUI controls use the same authenticated path as the CLI."""
+        app = FenrisTuiApp(store_path=tmp_path / "nonexistent.db")
+
+        with patch("fenris.tui.os.geteuid", return_value=1000), \
+             patch("fenris.tui.subprocess.run") as run, \
+             patch.object(app, "suspend"), \
+             patch.object(app, "_refresh"):
+            run.return_value.returncode = 0
+            app._run_helper("enable", ["--now"])
+
+        run.assert_called_once_with(
+            ["pkexec", "/usr/libexec/fenris/fenris-monitor", "enable", "--now"],
+            timeout=30,
+        )
+
     @pytest.mark.asyncio
     async def test_first_run_prompt(self, tmp_path):
         """First-run prompt makes the keyboard action and boot effect explicit."""