TestOrganisationLogo asserted only that the system_files rows go; it now
also waits for the commit and asserts the logo's and avatar's originals and
thumbnails are gone from the bucket. The Postgres tests of the gap closure
call t.Skip under -short instead of returning, so -short runs report them
as skipped, not passed.
ChangePassword fired the access-revoked event with Before = the calling
session's iat, so an OAuth/MCP grant whose client refreshed it after that
instant kept working. Before is now the instant of the request; the stored
tokens_valid_after still keeps the calling session.
- TestMemberTokenScopes walks E-2's acceptance list item by item, plus the
per-application catalog and the legacy MintAPIToken fallback;
TestMemberTokenScopesBoot (no Docker) the boot refusals
- TestBackendLinkAuthTime (C-CR-02), TestBackendLinkShowPost (C-WR-01,
C-IN-06), TestAccessRevocation (C-CR-01), TestUserMCPGuardClientIP
(C-IN-04), TestAPITokenRevokeEvent (C-IN-02), TestOrganisationLogo (E-1)
- README Testing section names them
