test: no test throws a response away; the stream session is narrowed, not baselined

The 7 baselined Optional accesses in plex/stream.py were one fact the type did not carry: the
initial spawn (replace_only=None) always supersedes, so only the fallback respawn can get None.
An assert at the call site says so; the pyright baseline drops 195 -> 188.

test_abuse_limits: the public-URL and YouTube enqueue tests stopped at the profile lookup
(400 no_profile) and passed on that unrelated refusal. They now send an inline spec and assert
the job is queued. The same shape — a request whose response is discarded — sat at 53 more
places across the suite (all returned what they should, measured with a TestClient probe);
each now asserts its status, and test_response_checked keeps it that way (seen red).

backend/tests/test_review_round.py

@@ -100,15 +100,22 @@ def test_a_later_registration_never_touches_an_existing_password(db, client, smt
     have installed a password where the whole point is that there is none. Reverted; the owner's
     recourse is password-reset, which proves the mailbox. Residual logged as SEC-16.
     """
-    client.post(
-        "/auth/register", json={"email": "victim@example.com", "password": "the first password"}
+    assert (
+        client.post(
+            "/auth/register", json={"email": "victim@example.com", "password": "the first password"}
+        ).status_code
+        == 200
     )
     db.expire_all()
     user = db.execute(select(User).where(User.email == "victim@example.com")).scalar_one()
     before = user.password_hash
 
-    client.post(
-        "/auth/register", json={"email": "victim@example.com", "password": "the second password"}
+    assert (
+        client.post(
+            "/auth/register",
+            json={"email": "victim@example.com", "password": "the second password"},
+        ).status_code
+        == 200
     )
 
     db.expire_all()
@@ -116,8 +123,11 @@ def test_a_later_registration_never_touches_an_existing_password(db, client, smt
 
 
 def test_a_later_registration_leaves_a_link_already_in_flight_alive(db, client, smtp_on, wire):
-    client.post(
-        "/auth/register", json={"email": "victim@example.com", "password": "the first password"}
+    assert (
+        client.post(
+            "/auth/register", json={"email": "victim@example.com", "password": "the first password"}
+        ).status_code
+        == 200
     )
     db.expire_all()
     user = db.execute(select(User).where(User.email == "victim@example.com")).scalar_one()
@@ -126,8 +136,12 @@ def test_a_later_registration_leaves_a_link_already_in_flight_alive(db, client,
     # would go green while asserting nothing the day registration stops issuing a token.
     assert len(first) == 1
 
-    client.post(
-        "/auth/register", json={"email": "victim@example.com", "password": "the second password"}
+    assert (
+        client.post(
+            "/auth/register",
+            json={"email": "victim@example.com", "password": "the second password"},
+        ).status_code
+        == 200
     )
 
     db.expire_all()
@@ -148,8 +162,12 @@ def test_a_stripped_account_keeps_its_recovery_stamp(db, client, smtp_on, make_u
         password_revoked_at=datetime.now(timezone.utc),
     )
 
-    client.post(
-        "/auth/register", json={"email": "stripped@example.com", "password": "an attacker password"}
+    assert (
+        client.post(
+            "/auth/register",
+            json={"email": "stripped@example.com", "password": "an attacker password"},
+        ).status_code
+        == 200
     )
 
     db.expire_all()
@@ -169,7 +187,9 @@ def test_a_denied_sibling_is_not_reopened_while_a_pending_row_exists(db, client)
     )
     db.commit()
 
-    client.post("/auth/request-access", json={"email": "pairone@gmail.com"})
+    assert (
+        client.post("/auth/request-access", json={"email": "pairone@gmail.com"}).status_code == 200
+    )
 
     db.expire_all()
     rows = {i.email: i.status for i in db.execute(select(Invite)).scalars().all()}
@@ -195,7 +215,7 @@ def test_an_env_granted_address_cannot_be_shadowed_by_a_stranger(db, client, mon
     # env grant. With the env list matched canonically the request never opens a row.
     monkeypatch.setattr(settings, "allowed_emails", "bob@gmail.com")
 
-    client.post("/auth/request-access", json={"email": "b.ob@gmail.com"})
+    assert client.post("/auth/request-access", json={"email": "b.ob@gmail.com"}).status_code == 200
 
     assert db.execute(select(Invite)).scalars().all() == []
     assert auth_core.is_allowed(db, "bob@gmail.com") is True
@@ -331,7 +351,12 @@ def test_two_admins_two_languages_two_mails(db, client, make_user, smtp_on, wire
     make_user(email="hu.admin@example.com", role="admin", preferences={"language": "hu"})
     make_user(email="en.admin@example.com", role="admin", preferences={"language": "en"})
 
-    client.post("/auth/request-access", json={"email": "asking@example.com", "lang": "en"})
+    assert (
+        client.post(
+            "/auth/request-access", json={"email": "asking@example.com", "lang": "en"}
+        ).status_code
+        == 200
+    )
 
     notices = [w for w in wire if "asking@example.com" in w[1]]
     assert len(notices) == 2