test(api): initialise persistent stores in bare auth fixtures

The exact normal and race API groups failed at the bare change-password fixture because Basic authentication requires an explicitly configured CSRF store. Give each fixture its own session and CSRF stores and join their workers at cleanup; retain the production fail-closed contract.

Contract-Neutral: Test fixture lifecycle only; production authentication and subsystem contracts are unchanged.
Change-source: pulse-maintainer

internal/api/router_auth_additional_test.go

@@ -17,6 +17,17 @@ import (
 
 func newAuthRouter(t *testing.T) *Router {
 	t.Helper()
+	dir := t.TempDir()
+	// Basic authentication creates both a session and its CSRF token. Bare
+	// handler fixtures must own that setup instead of relying on a previous
+	// router test to have initialized the process-wide stores.
+	InitSessionStore(dir)
+	InitCSRFStore(dir)
+	t.Cleanup(func() {
+		resetSessionStoreForTests()
+		resetCSRFStoreForTests()
+		resetSessionTracking()
+	})
 	hashed, err := auth.HashPassword("currentpassword")
 	if err != nil {
 		t.Fatalf("hash password: %v", err)
@@ -25,7 +36,7 @@ func newAuthRouter(t *testing.T) *Router {
 		config: &config.Config{
 			AuthUser:   "admin",
 			AuthPass:   hashed,
-			ConfigPath: t.TempDir(),
+			ConfigPath: dir,
 		},
 	}
 }