fix: remove unit tests redundant with e2e, fix test DB isolation

Remove 7 test files fully covered by e2e tests (admin, account, models,
API routes, integration MFA/OIDC, notifications). Trim 5 more files to
keep only edge cases not reachable via e2e.

Fix conftest to replace wiregui.db engine/session at import time so all
code uses the test database. Use session-scoped tables with per-test
savepoint isolation to prevent data leaking between tests.

tests/conftest.py

@@ -1,4 +1,12 @@
-"""Shared test fixtures — async DB session using a test database."""
+"""Shared test fixtures — async DB session using a test database.
+
+The module-level code below replaces ``wiregui.db.engine`` and
+``wiregui.db.async_session`` with instances pointing at the **test** database
+*before* any test (or other module) can grab a reference to the originals.
+This means every ``from wiregui.db import async_session`` — whether in test
+files or in production code like ``wiregui.utils.server_key`` — will get the
+test-database session maker.
+"""
 
 import os
 from collections.abc import AsyncGenerator
@@ -8,6 +16,7 @@ from sqlalchemy import text
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 from sqlmodel import SQLModel
 
+import wiregui.db as _db_module
 from wiregui.config import get_settings
 
 # All models must be imported so SQLModel.metadata knows about them
@@ -51,19 +60,41 @@ def _ensure_test_db_sync():
 
 _ensure_test_db_sync()
 
+# ---------------------------------------------------------------------------
+# Replace the production engine/session in wiregui.db at import time so that
+# every module that does ``from wiregui.db import async_session`` picks up the
+# test database.  This MUST happen before test modules are collected (which
+# triggers their top-level imports).
+# ---------------------------------------------------------------------------
+_test_engine = create_async_engine(TEST_DATABASE_URL)
+_test_session_factory = async_sessionmaker(_test_engine, expire_on_commit=False)
+_db_module.engine = _test_engine
+_db_module.async_session = _test_session_factory
+
+
+@pytest_asyncio.fixture(scope="session", autouse=True)
+async def _setup_test_tables():
+    """Create all tables once at the start of the test session, drop at end."""
+    async with _test_engine.begin() as conn:
+        await conn.run_sync(SQLModel.metadata.create_all)
+    yield
+    async with _test_engine.begin() as conn:
+        await conn.run_sync(SQLModel.metadata.drop_all)
+    await _test_engine.dispose()
+
 
 @pytest_asyncio.fixture
 async def session() -> AsyncGenerator[AsyncSession]:
-    """Fresh engine + session per test, with table setup/teardown."""
-    engine = create_async_engine(TEST_DATABASE_URL)
-    async with engine.begin() as conn:
-        await conn.run_sync(SQLModel.metadata.create_all)
+    """Per-test session with transaction isolation.
 
-    factory = async_sessionmaker(engine, expire_on_commit=False)
-    async with factory() as sess:
+    The session is bound to a connection-level transaction that is always
+    rolled back at teardown.  When tested code calls ``session.commit()``,
+    SQLAlchemy only releases a SAVEPOINT — the outer transaction is never
+    committed, so no test data persists between tests.
+    """
+    async with _test_engine.connect() as conn:
+        txn = await conn.begin()
+        sess = AsyncSession(bind=conn, expire_on_commit=False, join_transaction_mode="create_savepoint")
         yield sess
-        await sess.rollback()
-
-    async with engine.begin() as conn:
-        await conn.run_sync(SQLModel.metadata.drop_all)
-    await engine.dispose()
+        await sess.close()
+        await txn.rollback()