- TestRequestUser: bearer, token and auth_token cookies in guard order;
expired, foreign, blacklisted, revoked by tokens_valid_after and
deactivated tokens are anonymous; only infrastructure failures error
- TestEndRequestSession (no database): jti blacklisted until the token
expires, forget cookie with the configured Domain and Path, best effort
- TestAvatarURL: thumbnail, broken-image and storage-failure fallbacks,
gravatar with the size, the user payload's avatar_url unchanged
- TestDeactivatingEvent: one event per newly deactivated user inside the
bulk action's transaction, a listener error rolls the action back
