test(auth): stop proxy provisioning tests depending on run order

[splitsec2]

I hit this while building the Debrid-Link client in #1380. The new tests there changed the test count, that reshuffled the xdist workers, and these two went red. They were related to this branch, but were tests related to another PR I did which didn't have proper tests..

test_sets_session_from_header and test_reads_remote_user_wsgi_fallback both assert that a proxy-authenticated user comes back with is_admin is True. Since #1356 that only holds for the bootstrap account, because _proxy_default_is_admin returns True only while has_admin() is False. Both tests assume they're provisioning the first account, and only one of them can be.

Run with -n 0 so nothing is sharded:

either test alone	passes
both, file order	the second fails
both, reversed	the second fails
both, across 2 workers	both pass

Reversing the order moving which one breaks is what makes it an ordering problem rather than a real one.

It stays green on CI because the suite runs with -n auto and tests/conftest.py calls mkdtemp at module level, which runs once per worker process. Each worker gets its own CONFIG_DIR and its own users.db, the two tests land on different workers, and each one is genuinely first in its own database. That passed but it's luck rather than design, and any change to the test count can put them back together.

So this gives every test in the file an empty user table and stops the question of who ran first from mattering.

While I was fixed that I added coverage for the rule itself, which I had failed to test for:

• the bootstrap account is an admin and the next one isn't
• PROXY_AUTH_DEFAULT_ROLE=admin promotes later accounts
• a user already in the database keeps its stored role instead of picking up the default

Tests only, no source changes. The full suite passes serially now, where it had those two failures before, and it's still green under -n auto.