test(auth): cover lockout table full slot-0 eviction

[cursor]

Summary

Adds unit coverage for /pair brute-force lockout when the in-memory IP table is full.

Risky behavior now covered

• Full lockout table (32 IPs): the 33rd IP reuses slot 0, so the first IP loses its lockout while later slots stay locked.

Test files added/updated

• tests/test_auth.c — test_pair_lockout_table_full_evicts_slot_zero

Why this reduces regression risk

Lockout is the gateway's pairing brute-force control. Silent slot-0 eviction is easy to break in a refactor (LRU change, wrong free-slot scan) and would either drop protection for early attackers or fail to admit new IPs. This test pins the current policy without changing production code.

Validation

make GATEWAY=0 test_auth && ./build/test_auth

Result: test_auth: all tests passed

Notes

• No production behavior changes.
• Complements open PR test(auth): cover token cap eviction and malformed pairing codes #48 (token cap / malformed codes / length mismatch) on a separate branch.
• Still blocked without libwebsockets: WS bearer auth, http_dispatch_body 413, parse_memory_limit_arg.

  

[cursor]

PR Summary

Low Risk
Test-only changes to auth unit tests; no modifications to pairing, token, or lockout implementation.

Overview
Expands tests/test_auth.c with helpers and integration-style cases that pin gateway auth edge behavior without changing production code.

Adds cJSON-backed helpers to seed and inspect the on-disk token JSON array, plus tests that auth_pair rejects malformed 6-digit codes (wrong length, non-digits, empty) while a valid pending code still works; that pairing at the 16-token cap evicts the oldest token and keeps array size at 16; and that auth_validate_token rejects tokens longer than the stored 32-char hex.

Adds test_pair_lockout_table_full_evicts_slot_zero, which fills all 32 lockout slots, then asserts the 33rd IP reuses slot 0 so the first IP is no longer locked out while other slots (including the new IP after max failures) remain locked—documenting current lockout_find_or_create overflow policy.

^{Reviewed by Cursor Bugbot for commit ce3211c. Bugbot is set up for automated code reviews on this repo. Configure here.}