test(be): every dependency override goes through override_dep

22 test files set `app.dependency_overrides[...]` by hand and tore down with a blanket `.clear()`
in a `finally`, which wipes every override rather than the test's own and stops fixtures composing.
They now take the `override_dep` fixture (helpers get it passed in), whose teardown restores each
key's prior value; no clear() carried meaning between two phases of a test. A convention test fails
any test file that writes `dependency_overrides` directly.

backend/tests/test_feed_cursor.py

@@ -15,34 +15,31 @@ from app.main import app
 from app.models import User
 
 
-def _get(db, user, monkeypatch, path):
+def _get(db, user, monkeypatch, override_dep, path):
     monkeypatch.setattr(
         state, "_configured_cache", True
     )  # the request gate 503s an unconfigured app
-    app.dependency_overrides[get_db] = lambda: db
-    app.dependency_overrides[current_user] = lambda: user
-    try:
-        client = TestClient(app)  # no context manager: skip lifespan (scheduler/HLS sweep)
-        return client.get(path)
-    finally:
-        app.dependency_overrides.clear()
+    override_dep(get_db, lambda: db)
+    override_dep(current_user, lambda: user)
+    client = TestClient(app)  # no context manager: skip lifespan (scheduler/HLS sweep)
+    return client.get(path)
 
 
-def test_malformed_feed_cursor_returns_400(db, monkeypatch):
+def test_malformed_feed_cursor_returns_400(db, monkeypatch, override_dep):
     user = User(email="feedcursor@example.com")
     db.add(user)
     db.commit()
-    resp = _get(db, user, monkeypatch, "/api/feed?cursor=not-a-real-cursor")
+    resp = _get(db, user, monkeypatch, override_dep, "/api/feed?cursor=not-a-real-cursor")
     assert resp.status_code == 400
     assert resp.json()["detail"] == {"code": "refused", "reason": "invalid_cursor"}
 
 
-def test_feed_without_cursor_is_200(db, monkeypatch):
+def test_feed_without_cursor_is_200(db, monkeypatch, override_dep):
     # Sanity: the same endpoint without a cursor is a normal 200 (proves the 400 above is the
     # cursor path, not a globally-broken request). A fresh user has no subscriptions → empty feed.
     user = User(email="feednocursor@example.com")
     db.add(user)
     db.commit()
-    resp = _get(db, user, monkeypatch, "/api/feed")
+    resp = _get(db, user, monkeypatch, override_dep, "/api/feed")
     assert resp.status_code == 200
     assert resp.json()["items"] == []