test(be): every dependency override goes through override_dep

22 test files set `app.dependency_overrides[...]` by hand and tore down with a blanket `.clear()`
in a `finally`, which wipes every override rather than the test's own and stops fixtures composing.
They now take the `override_dep` fixture (helpers get it passed in), whose teardown restores each
key's prior value; no clear() carried meaning between two phases of a test. A convention test fails
any test file that writes `dependency_overrides` directly.

backend/tests/test_plex_playback_session.py

@@ -48,7 +48,7 @@ def _user(db, email="play@example.com"):
     return u
 
 
-def _post(db, user, monkeypatch, rating_key, *, captured):
+def _post(db, user, monkeypatch, override_dep, rating_key, *, captured):
     """Drive the endpoint with ffmpeg stubbed out. `start_session` records the `transcode` flag it
     was called with into `captured` and returns a stand-in session echoing it back."""
     monkeypatch.setattr(state, "_configured_cache", True)  # pass the request gate
@@ -67,20 +67,17 @@ def _post(db, user, monkeypatch, rating_key, *, captured):
         )
 
     monkeypatch.setattr(plex_stream, "start_session", fake_start)
-    app.dependency_overrides[get_db] = lambda: db
-    app.dependency_overrides[current_user] = lambda: user
-    try:
-        return TestClient(app).post(f"/api/plex/stream/{rating_key}/session")
-    finally:
-        app.dependency_overrides.clear()
+    override_dep(get_db, lambda: db)
+    override_dep(current_user, lambda: user)
+    return TestClient(app).post(f"/api/plex/stream/{rating_key}/session")
 
 
-def test_transcode_item_routes_to_an_hls_reencode_session(db, monkeypatch):
+def test_transcode_item_routes_to_an_hls_reencode_session(db, monkeypatch, override_dep):
     # A non-h264 item (formerly HTTP 501) now plays: mode=hls, transcode=True threaded to start_session.
     it = _item(db, playable="transcode")
     user = _user(db)
     captured: dict = {}
-    resp = _post(db, user, monkeypatch, it.rating_key, captured=captured)
+    resp = _post(db, user, monkeypatch, override_dep, it.rating_key, captured=captured)
     assert resp.status_code == 200, resp.text
     body = resp.json()
     assert body["mode"] == "hls"
@@ -88,12 +85,12 @@ def test_transcode_item_routes_to_an_hls_reencode_session(db, monkeypatch):
     assert captured["transcode"] is True  # start_session was told to re-encode
 
 
-def test_remux_item_stays_a_stream_copy_session(db, monkeypatch):
+def test_remux_item_stays_a_stream_copy_session(db, monkeypatch, override_dep):
     # A remux (h264) item takes the SAME HLS path but must NOT re-encode.
     it = _item(db, playable="remux", rating_key="m2")
     user = _user(db, "remux@example.com")
     captured: dict = {}
-    resp = _post(db, user, monkeypatch, it.rating_key, captured=captured)
+    resp = _post(db, user, monkeypatch, override_dep, it.rating_key, captured=captured)
     assert resp.status_code == 200, resp.text
     body = resp.json()
     assert body["mode"] == "hls"
@@ -101,12 +98,12 @@ def test_remux_item_stays_a_stream_copy_session(db, monkeypatch):
     assert captured["transcode"] is False
 
 
-def test_direct_item_never_opens_a_session(db, monkeypatch):
+def test_direct_item_never_opens_a_session(db, monkeypatch, override_dep):
     # A browser-native file is served raw — start_session is never reached, so no transcode decision.
     it = _item(db, playable="direct", rating_key="m3")
     user = _user(db, "direct@example.com")
     captured: dict = {}
-    resp = _post(db, user, monkeypatch, it.rating_key, captured=captured)
+    resp = _post(db, user, monkeypatch, override_dep, it.rating_key, captured=captured)
     assert resp.status_code == 200, resp.text
     assert resp.json()["mode"] == "direct"
     assert "transcode" not in captured  # start_session not called