fix(auth): Google adoption revokes the password of a never-activated account

Without SMTP, registration marks the address verified with no proof, and an ADMIN_EMAILS /
ALLOWED_EMAILS address gets no invite row to gate it. So a stranger who registered such an address
(or a sibling spelling) before its owner kept their own password when the owner's first Google
sign-in adopted the row, activated it and made it admin, and could then sign in with it.

The adoption now treats a never-activated row like an unverified one: the password goes,
password_revoked_at is stamped and the session epoch bumped. An account already let in keeps its
password. The helper is renamed to say what it now judges (revoke_untrusted_preset_password).

test_google_callback.py drives the callback's account-matching branches through the real route,
none of which a test ran before: the squat (red on the old rule), adoption by mailbox, the
sub-collision and unverified-address refusals, the refused sign-in recorded in Google's locale, and
the link flow's conflict, mismatch and attach answers.

backend/tests/test_auth_session.py

@@ -491,9 +491,9 @@ def test_register_route_is_refused_when_registration_is_closed(client, db, monke
 def _revoke_as_google_adoption(db, user) -> None:
     """Put an account into the SEC-10-revoked state the way the ONLY remaining producer does: the
     Google callback adopting an account whose email was never verified."""
-    from app.routes.auth import revoke_preset_password_if_unverified
+    from app.routes.auth import revoke_untrusted_preset_password
 
-    revoke_preset_password_if_unverified(user)
+    revoke_untrusted_preset_password(user)
     db.commit()