"""Tests runnable with plain pytest -- no FastAPI, no TestClient.

These focus on the security-critical primitives so regressions are caught
before the heavy HTTP smoke tests fire.
"""