test(be): every dependency override goes through override_dep

22 test files set `app.dependency_overrides[...]` by hand and tore down with a blanket `.clear()`
in a `finally`, which wipes every override rather than the test's own and stops fixtures composing.
They now take the `override_dep` fixture (helpers get it passed in), whose teardown restores each
key's prior value; no clear() carried meaning between two phases of a test. A convention test fails
any test file that writes `dependency_overrides` directly.

backend/tests/test_hls_reaper.py

@@ -142,13 +142,15 @@ def _library_item(db, rating_key: str, *, playable: str = "remux"):
     return it
 
 
-def _client(db, user):
-    app.dependency_overrides[get_db] = lambda: db
-    app.dependency_overrides[current_user] = lambda: user
+def _client(db, user, override_dep):
+    override_dep(get_db, lambda: db)
+    override_dep(current_user, lambda: user)
     return TestClient(app)
 
 
-def test_a_paused_viewers_checkpoint_keeps_their_session_alive(db, monkeypatch, tmp_path, sessions):
+def test_a_paused_viewers_checkpoint_keeps_their_session_alive(
+    db, monkeypatch, tmp_path, sessions, override_dep
+):
     """The whole reason the short rule is safe again: a paused player fetches nothing, so
     `last_access` never moved on its own — but it does keep checkpointing its position."""
     monkeypatch.setattr(state, "_configured_cache", True)
@@ -158,20 +160,17 @@ def test_a_paused_viewers_checkpoint_keeps_their_session_alive(db, monkeypatch,
     db.commit()
     s = _Session(tmp_path, "paused", finished=True, idle_s=90)
     sessions[(user.id, "paused1")] = s
-    try:
-        resp = _client(db, user).post(
-            f"/api/plex/item/{it.rating_key}/progress",
-            json={"position_seconds": 600, "duration_seconds": 3000, "final": False},
-        )
-    finally:
-        app.dependency_overrides.clear()
+    resp = _client(db, user, override_dep).post(
+        f"/api/plex/item/{it.rating_key}/progress",
+        json={"position_seconds": 600, "duration_seconds": 3000, "final": False},
+    )
     assert resp.status_code == 200, resp.text
     assert stream.reap_idle() == 0, "the checkpoint did not say the viewer is still there"
     assert (user.id, "paused1") in sessions and not s.proc.killed
 
 
 def test_starting_a_session_leaves_another_viewers_paused_one_alone(
-    db, monkeypatch, tmp_path, sessions
+    db, monkeypatch, tmp_path, sessions, override_dep
 ):
     """The opportunistic sweep this route used to run was not scoped to the key being started: it
     walked the WHOLE registry with the 30 s finished rule, so pressing play on any item killed a
@@ -196,9 +195,6 @@ def test_starting_a_session_leaves_another_viewers_paused_one_alone(
         )
 
     monkeypatch.setattr(stream, "start_session", fake_start)
-    try:
-        resp = _client(db, user).post(f"/api/plex/stream/{started.rating_key}/session")
-    finally:
-        app.dependency_overrides.clear()
+    resp = _client(db, user, override_dep).post(f"/api/plex/stream/{started.rating_key}/session")
     assert resp.status_code == 200, resp.text
     assert (999, "someone-else") in sessions and not paused.proc.killed