test(auth): pin what rounds 1 and 2 left unpinned (E9.5 review round 3)

Three low findings, all in what the review rounds themselves wrote.

The comment on `test_approving_an_unverified_account_keeps_its_password` still asserted the argument
rounds 1 and 2 refuted — that dropping the approval-time revoke was safe because `password_login`
reads `email_verified` first — while the docstrings on the two functions it describes now say the
opposite. Two contradictory "why" records for one rule is how the round-1 takeover primitive got
reasoned into existence in the first place, so the test comment now carries the corrected account
and names SEC-16.

`test_a_later_registration_leaves_a_link_already_in_flight_alive` asserted a subset relation that is
vacuously true on an empty set, and the guard that made it non-empty had gone out with the revert.
It now pins both halves: the old link survives, and exactly one new one appears.

Round 2's own fix — activation moved to after a successful send — was unpinned; putting it back
above the send left the suite green. The failed-invitation test now also asserts the account was not
activated by a request the UI reported as a failure.

backend/tests/test_review_round.py

@@ -122,6 +122,9 @@ def test_a_later_registration_leaves_a_link_already_in_flight_alive(db, client,
     db.expire_all()
     user = db.execute(select(User).where(User.email == "victim@example.com")).scalar_one()
     first = db.execute(select(AuthToken.id).where(AuthToken.user_id == user.id)).scalars().all()
+    # Not just a subset check below: `set() <= set()` is vacuously true, so without this the test
+    # would go green while asserting nothing the day registration stops issuing a token.
+    assert len(first) == 1
 
     client.post(
         "/auth/register", json={"email": "victim@example.com", "password": "the second password"}
@@ -130,7 +133,7 @@ def test_a_later_registration_leaves_a_link_already_in_flight_alive(db, client,
     db.expire_all()
     live = db.execute(select(AuthToken.id).where(AuthToken.user_id == user.id)).scalars().all()
     # The re-send adds a link; it must not invalidate the one the owner may already be holding.
-    assert set(first) <= set(live)
+    assert set(first) <= set(live) and len(live) == len(first) + 1
 
 
 def test_a_stripped_account_keeps_its_recovery_stamp(db, client, smtp_on, make_user):
@@ -244,11 +247,14 @@ def test_deleting_one_of_two_accounts_leaves_the_other_one_allowed(db, make_user
 # --- a button an admin pressed must not report a send that did not happen -------------------------
 
 
-def test_a_failed_invitation_is_not_recorded_as_written(
+def test_a_failed_invitation_changes_nothing_the_admin_was_told_about(
     db, make_user, as_user, smtp_on, monkeypatch
 ):
     monkeypatch.setattr(email_mod, "send_access_invitation", lambda *a, **kw: False)
     admin = make_user(email="admin@example.com", role="admin")
+    stranger = make_user(
+        email="stranger@example.com", password=_PW, email_verified=False, is_active=False
+    )
     inv = Invite(email="stranger@example.com", status="approved")
     db.add(inv)
     db.commit()
@@ -260,6 +266,9 @@ def test_a_failed_invitation_is_not_recorded_as_written(
     # The column exists to answer "did I already write to them?", and the UI dims the button and
     # warns about a second mail on the strength of it. A dropped send must not make it say yes.
     assert db.get(Invite, inv.id).invited_at is None
+    # And a request the UI reports as a failure must not have let somebody in behind the admin's
+    # back — the activation belongs after a mail that actually left.
+    assert db.get(User, stranger.id).is_active is False
 
 
 def test_a_failed_resend_says_so_instead_of_reporting_ok(