fix(tests): collect tests/, and correct the two assertions that never ran - #314

… its own contract (#315)

Two failures on main, neither of which any single PR's CI could have caught.

**`provider.py` at 305 lines.** #309 and #314 were each green against the main
they branched from; squash-merging both put the file over the 300-line cap. Split
on the seam already there: `_resolve_bearer` moves to `token_strategy`, which is
where `ExpiringDatabaseStrategy` lives. Those two are the only readers of
`users_access_token` and they have to apply the same deadline and
`session_version` rules — keeping them in one file is what stops them drifting.
`provider.py` keeps a one-line delegate so the method stays on the provider's
surface. 305 → 265, and `token_strategy` → 164.

**`setup_pending_app` boots *with* an administrator.** `UsersModule.on_startup`
seeds one from `SM_USERS_BOOTSTRAP_*`, read from the environment *and* from a
`.env` on disk. A developer who followed `.env.example` has those set, so the
fixture whose entire contract is "an app with no administrator" hands back an app
that has two — the setup gate releases, the wizard routes 404, and eleven tests
in `framework/hosting/tests` fail. CI has no `.env`, so it never saw this: the
failure was local-only, which is the worst shape for a fixture to be wrong in.
It also looked like test-ordering noise, because whether it reproduced depended
on what else had booted an app first.

The fixture now scrubs the bootstrap vars and stubs the dotenv reader for the
app it builds, the same way `modules/users/tests/conftest.py` does for its own.
Adding that pushed `fixtures.py` over the cap too, so the schema machinery
(model imports, alembic heads, table creation) moves to `_schema.py` — that
module declares fixtures, this one is what they stand on.

The second half of #295. Its first half — the two assertions that never ran —
closed in #314; these are the units the branch shipped with no test at all,
plus one assertion that could not fail.

`scripts/gen_i18n.py` was the only script in `scripts/` with no test beside it.
What it pins is the property #302 added: the command's exit code has to tell
"wrote the key files" from "wrote nothing", and both halves of the `strict`
flag — the boot path still preferring stale types to a failed start.

`user_state` and `deriveState` are the same rule in two languages, because the
edit page recomputes the status pill after a local change without a reload.
Nothing held them together, so the first edit to either would have drifted them
silently. They now share one six-row table, written out in both suites, and the
Python side asserts the table covers every declared state.

`PasswordInput`'s reveal toggle, `useLeaveGuard`, `Error.tsx`'s 403 branch and
`file_storage`'s `SelectionFooter` and `showEmpty` had no tests. The two worth
naming:

- `useLeaveGuard` was stubbed out by both page suites (`router: { on: () => () => {} }`),
  so neither the prompt nor its escape hatch ran. The escape hatch is the
  load-bearing half: the page's own save is an Inertia visit too, and prompting
  on it would ask "discard your changes?" while saving them.
- `showEmpty` keys on `pagination.total`, not `files.length`. A page past the
  last one renders an empty `files` array while the bucket is full, so the
  simpler condition would announce "No files yet" over a full bucket. Its copy
  also splits on whether a filter is active, because "No files yet" is wrong and
  discouraging when the filter is merely too narrow.

`_clamp`'s out-of-range branch — zero, negative, `None`, a numeric string, and
both bools, since `bool` is an `int` and `True` must not read as one second.

And `test_remember_me.py`'s `if reissued is not None:` becomes an assertion. It
let the test pass when the page wrote no session cookie at all, which is exactly
the case where it has stopped exercising the regression.

Closes #295