ChangePassword fired the access-revoked event with Before = the calling
session's iat, so an OAuth/MCP grant whose client refreshed it after that
instant kept working. Before is now the instant of the request; the stored
tokens_valid_after still keeps the calling session.
- TestMemberTokenScopes walks E-2's acceptance list item by item, plus the
per-application catalog and the legacy MintAPIToken fallback;
TestMemberTokenScopesBoot (no Docker) the boot refusals
- TestBackendLinkAuthTime (C-CR-02), TestBackendLinkShowPost (C-WR-01,
C-IN-06), TestAccessRevocation (C-CR-01), TestUserMCPGuardClientIP
(C-IN-04), TestAPITokenRevokeEvent (C-IN-02), TestOrganisationLogo (E-1)
- README Testing section names them
