- TestBackendLink: the fresh sign-in rule at the second, 1:1 on the
frontend side, the show route's three keys, SetLink and RemoveLink events
(none after a rollback), deactivated or deleted administrators, and
deactivating the frontend user
- TestFrontendPermissionCatalog: a second plugin's duplicate and an empty
code dropped; a group saved with a declared code grants it
- TestUserMCPGuard: parser refusals, a soft-deleted user, an expired token,
and the dispatch credential against the route's own user.scope:read
