test: repair the suite against the current API

The suite could not even collect: the venv was missing declared dependencies,
and five tests asserted an API that had moved on. 11 collection errors to 381
passing.

test_oidc.py was written for the single-issuer API and 6243f29 replaced it.
issuer and audience became lists, jwks_uri stopped being an attribute in
favour of get_jwks_uri(issuer), get_jwks became get_jwks_for_issuer, and the
lru_cache became a per-issuer dict so cache_clear no longer exists. Rewritten
against the current surface, with coverage added for the two behaviours the
multi-issuer change introduced and never tested: is_valid_issuer rejecting an
unconfigured issuer, and the cache keying per issuer. Both are
security-relevant — a shared cache would serve one issuer keys for another.

Three /auth/me tests asserted a path that does not exist. The route is
declared as /me inside AuthController.create_router() and mounts at
/auth/users/me; the generated spec is authoritative and the local app and the
deployed service agree on it. Those tests had never passed.

test_handles_empty_groups expected groups == [""] for an empty header. oidc.py
has returned [] since the initial commit, and [] is correct — [""] would also
be unsafe, since any check doing "" in groups would match.

test_model_aliases_property covered Settings.model_aliases, deleted with the
Ollama integration in c1f16d4. Removed rather than repaired.

Co-Authored-By: Claude <noreply@anthropic.com>

tests/test_config.py

@@ -89,10 +89,6 @@ class TestGetSettings:
         settings2 = get_settings()
         assert settings1 is settings2
 
-    def test_model_aliases_property(self):
-        """Model aliases property should return dict."""
-        settings = get_settings()
-        aliases = settings.model_aliases
-        assert isinstance(aliases, dict)
-        assert "gpt-3.5-turbo" in aliases
-        assert "gpt-4" in aliases
+    # Removed: test_model_aliases_property. Settings.model_aliases mapped
+    # gpt-3.5-turbo and gpt-4 onto local models, and was deleted along with the
+    # Ollama integration in c1f16d4. The test outlived the feature it covered.