Add tests for cookie-BFF auth, desktop tokens, and OneDrive picker scoping

[martsokha]

Tracks the testing deferred from the auth + connector work landed in feat/oidc-sign-in (commit e900961). The feature code shipped without end-to-end coverage of the new paths; this issue collects what needs tests.

Auth session / cookie transport

• Dual-transport AuthHeader: cookie (nvisy.session) preferred, falls back to Authorization: Bearer; AuthTransport recorded correctly.
• CSRF (csrf_protect): unsafe method + cookie auth requires matching X-CSRF-Token == nvisy.csrf; bearer auth is exempt; constant-time compare.
• Middleware order: require_authentication → csrf_protect → slide_session.
• OptionalFromRequestParts fail-closed: infra errors propagate, only 401-class map to None.
• Session cookie set on login/signup/logout; logout clears both cookies and revokes the row.

Desktop auth (#285)

• OIDC desktop branch: a registered desktop-scheme redirectUri mints an App token and redirects scheme://…?token=<jwt> with no cookie; a web origin still sets the cookie.
• POST /auth/desktop/token: authed; rejects a non-desktop-scheme redirectUri (400); mints an App token for the caller.
• classify_redirect unit coverage exists; add the endpoint-level (authed HTTP) tests.
• redirect_to_frontend no-redirect fallback fails loudly (500) when carrying a token instead of silently dropping it.
• App-token exemption from sliding + absolute cap, and prune_app_tokens (DB-gated tests exist, marked #[ignore]) — wire into a real DB CI run.

OneDrive picker token (business-only)

• mint_picker_token for OneDrive resolves the SharePoint host and mints a {host}/.default token; the connector Graph token is untouched.
• Personal/consumer account (no SharePoint host) is refused with a clear 4xx, not unauthenticated.
• Google Drive / Box picker paths unchanged (return the ordinary provider token); Dropbox rejected.
• refresh_with_scopes requests the scoped audience; empty scopes == the old refresh_tokens behavior.
• Optional { resource } body: absent body works (Google/Box), present body scopes the mint (OneDrive).

Harness gap

There is currently no authed-request integration harness in nvisy-server (log in → carry session cookie/CSRF → hit a protected endpoint). Several items above need it; building that harness is a prerequisite and part of this work.

Blocking follow-up (separate from tests)

The OneDrive business picker is code-complete but not functional until the Azure app + connector OAuth grant include SharePoint delegated permissions (MyFiles.Read/.Write, AllSites.Read) — the {host}/.default token is empty otherwise. Tracked separately; noted here because the picker tests depend on it.

[martsokha]

Add concurrency (interleaving) tests for the account-identity vs delete_account race fixed in the CodeRabbit review (PR #284, review 5136838225):

• link_oidc_identity interleaved with delete_account: the identity insert must not land on a tombstoned account (the FOR UPDATE account lock + deleted_at recheck should reject it as not-found).
• upsert_password_secret interleaved with delete_account: same guarantee.

These are DB-gated (two racing transactions), so they belong with the DB integration harness this issue already tracks.