test(fixtures): make the TestClient fixtures isolated and composable (S2 review)

Address the /code-review findings on the S2 test-net:
- as_user no longer sets a global `lambda: user` override that two users in one
  test would collide on; the shared current_user override now resolves the caller
  from an x-test-user header, and each returned client tags its own requests, so
  as_user(a)/as_user(b) are independent (#1).
- override_dep records the prior value per dependency key and restores it on
  teardown instead of a blanket dependency_overrides.clear(), so fixtures compose
  without clobbering each other (#5).
- a _configured fixture bakes the post-setup state into client/as_user, and the
  per-test inline monkeypatch / autouse duplicates are removed (#4).
- the feed keyset walk asserts all seeded rows surfaced before comparing, so a
  seeding regression can't make the sorts pass vacuously (#3).

backend/tests/test_auth_session.py

@@ -11,20 +11,14 @@ Note: `/api/me` is the bootstrap probe — it returns 200 `{authenticated: False
 """
 from datetime import timedelta
 
-import pytest
 from fastapi.testclient import TestClient
 
-import app.state as state
 from app.auth import ACTIVE_ACCOUNT_HEADER
 from app.main import app
 
 _PW = "correct horse battery"
 
-
-@pytest.fixture(autouse=True)
-def _configured(monkeypatch):
-    # The setup gate 503s /auth and /api until the wizard has run; every test here is post-setup.
-    monkeypatch.setattr(state, "_configured_cache", True)
+# The `client`/`as_user` fixtures bake in the post-setup `_configured` state, so no per-test patch here.
 
 
 def _login(client, email, password):