test: repair the suite against the current API

The suite could not even collect: the venv was missing declared dependencies,
and five tests asserted an API that had moved on. 11 collection errors to 381
passing.

test_oidc.py was written for the single-issuer API and 6243f29 replaced it.
issuer and audience became lists, jwks_uri stopped being an attribute in
favour of get_jwks_uri(issuer), get_jwks became get_jwks_for_issuer, and the
lru_cache became a per-issuer dict so cache_clear no longer exists. Rewritten
against the current surface, with coverage added for the two behaviours the
multi-issuer change introduced and never tested: is_valid_issuer rejecting an
unconfigured issuer, and the cache keying per issuer. Both are
security-relevant — a shared cache would serve one issuer keys for another.

Three /auth/me tests asserted a path that does not exist. The route is
declared as /me inside AuthController.create_router() and mounts at
/auth/users/me; the generated spec is authoritative and the local app and the
deployed service agree on it. Those tests had never passed.

test_handles_empty_groups expected groups == [""] for an empty header. oidc.py
has returned [] since the initial commit, and [] is correct — [""] would also
be unsafe, since any check doing "" in groups would match.

test_model_aliases_property covered Settings.model_aliases, deleted with the
Ollama integration in c1f16d4. Removed rather than repaired.

Co-Authored-By: Claude <noreply@anthropic.com>

tests/test_auth_controller.py

@@ -815,22 +815,32 @@ class TestPhase4Schemas:
 
 
 # =============================================================================
-# GET /auth/me Endpoint Tests (NPM Forward Auth)
+# GET /auth/users/me Endpoint Tests (NPM Forward Auth)
 # =============================================================================
 
 class TestAuthMeEndpoint:
-    """Test GET /auth/me endpoint with NPM forward auth."""
+    """
+    Test GET /auth/users/me with NPM forward auth.
+
+    The path is /auth/users/me, not /auth/me — the route is declared as "/me"
+    inside AuthController.create_router(), which mounts under a users prefix.
+    These tests asserted /auth/me and had never passed; the generated spec is
+    authoritative and both the local app and the deployed service agree on 62
+    paths including this one.
+    """
+
+    PATH = "/auth/users/me"
 
     def test_auth_me_in_openapi(self, client):
         """Auth me endpoint should be in OpenAPI spec."""
         response = client.get("/openapi.json")
         spec = response.json()
-        assert "/auth/me" in spec["paths"]
-        assert "get" in spec["paths"]["/auth/me"]
+        assert self.PATH in spec["paths"]
+        assert "get" in spec["paths"][self.PATH]
 
     def test_auth_me_returns_401_without_forward_auth(self, client):
         """Should return 401 when accessed without forward auth headers."""
-        response = client.get("/auth/me")
+        response = client.get(self.PATH)
         # Without NPM forward auth headers, should return 401
         assert response.status_code == 401
 
@@ -840,7 +850,7 @@ class TestAuthMeEndpoint:
         spec = response.json()
 
         # Check response schema references AuthSyncResponse
-        me_endpoint = spec["paths"]["/auth/me"]["get"]
+        me_endpoint = spec["paths"][self.PATH]["get"]
         assert "responses" in me_endpoint
         assert "200" in me_endpoint["responses"]
 
@@ -920,7 +930,11 @@ class TestForwardAuthParsing:
 
         result = await get_forward_auth_user(mock_request)
 
-        assert result["groups"] == [""]
+        # An empty groups header means no groups, not one group named "".
+        # oidc.py has guarded this since the initial commit — this assertion
+        # expected [""] and had never passed. [""] would also be unsafe: any
+        # authorization check doing `"" in groups` would match.
+        assert result["groups"] == []
         assert result["name"] == "jdoe"  # Falls back to username
 
     @pytest.mark.asyncio