test(auth,gateway): cover pending-less pair and window slide guard

[cursor]

Summary

• Cover auth_pair when no pending pairing code was issued (fail closed).
• Cover ASAP rate-limit over-limit hits near the window edge so window_start cannot be slid forward.

Risky behavior now covered

• Pairing without bootstrap must not mint a bearer token.
• Clients cannot keep an ASAP rate window alive forever by retrying while limited.

Test files added/updated

• tests/test_auth.c — test_auth_pair_rejects_without_pending_code
• tests/test_rate_limit.c — test_limited_calls_do_not_extend_window

Why this reduces regression risk

These are auth fail-closed and rate-limit availability edge paths. A silent refactor that issues tokens without a pending code, or that refreshes window_start on every limited hit, would otherwise ship without CI signal.

Validation

make GATEWAY=0 test_auth test_rate_limit && ./build/test_auth && ./build/test_rate_limit

Both binaries reported all tests passed.

Notes

Does not overlap open drafts #48/#49 or branch cursor/test-coverage-automation-c4f4 (table-full / single-use pairing).

  

[cursor]

PR Summary

Low Risk
Test-only changes with no modifications to auth or rate-limit implementation code.

Overview
Adds unit tests only—no production changes—to lock in gateway auth and ASAP rate-limit edge behavior that is easy to break in refactors.

tests/test_auth.c gains JSON helpers and several new cases: pairing fails closed when no pending code was issued; malformed pairing codes are rejected without minting tokens; at the 16-token cap, pairing evicts the oldest token while keeping the list size fixed; token validation rejects length mismatches; and when the 32-slot lockout table is full, slot 0 reuse drops the first IP’s lockout while other IPs stay locked.

tests/test_rate_limit.c adds test_limited_calls_do_not_extend_window, asserting that over-limit hits near the window edge do not slide window_start, so clients cannot keep a rate window alive indefinitely by retrying while limited.

^{Reviewed by Cursor Bugbot for commit 840d4ef. Bugbot is set up for automated code reviews on this repo. Configure here.}