fix(auth): a cancel at Google lands where the browser is; the probe says why it refused

A refused session keeps its cookie, so the cancel branch, keyed on the cookie's account, sent a
signed-out browser to the in-app toast the login page never shows: it now asks whether the
session holds. The probe's log line named every refusal 'its account no longer holds'; it now
carries the reason. The pruning docstring says again that a renewal may land a request's time
after the revoke, and the test pins the day of margin. The test clock clamps in the zone asked for.

backend/tests/conftest.py

@@ -332,7 +332,9 @@ class _NeverBack(_dt.datetime):
         t = cls.clock.now(tz)
         last = cls.last
         if last is not None and (last.tzinfo is None) == (t.tzinfo is None) and t <= last:
-            t = last + _dt.timedelta(microseconds=1)
+            # In the zone asked for: a Pacific reading clamped to a UTC one gave the UTC date.
+            nudged = last + _dt.timedelta(microseconds=1)
+            t = nudged.astimezone(t.tzinfo) if t.tzinfo is not None else nudged
         cls.last = t
         return t