Tests: keep auth and runtime files out of the real data directory.

Login bootstraps data/auth/mcp_token, so a full pytest run replaced the
running API's MCP token. Point every data/ path at the temp test state,
and pin single-session mode in the test that depends on it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/conftest.py

@@ -12,6 +12,18 @@ _TEST_STATE = TemporaryDirectory(prefix="netx-tests-", ignore_cleanup_errors=Tru
 _TEST_DATABASE_URL = f"sqlite:///{(Path(_TEST_STATE.name) / 'netx.sqlite').as_posix()}"
 os.environ["NETX_DATABASE_URL"] = _TEST_DATABASE_URL
 os.environ["NETX_CREDENTIAL_SECRET_FILE"] = str(Path(_TEST_STATE.name) / "credential_secret")
+# Login bootstraps the MCP token file; relative defaults would land in the
+# real data/ directory and break the running API's MCP token.
+for _key, _rel in {
+    "NETX_AUTH_SECRET_FILE": "auth/jwt_secret",
+    "NETX_AUTH_MCP_TOKEN_FILE": "auth/mcp_token",
+    "NETX_NE_COLLECTION_DATA_DIR": "ne_collections",
+    "NETX_BIZ_STATE_SPOOL_DIR": "biz_state_spool",
+    "NETX_NE_EXEC_JOB_DIR": "ne_exec_jobs",
+    "NETX_WEBCRT_DATA_DIR": "webcrt",
+    "NETX_SCHEDULER_HEARTBEAT_PATH": "runtime/scheduler_heartbeat.json",
+}.items():
+    os.environ[_key] = str(Path(_TEST_STATE.name) / _rel)
 
 
 def pytest_sessionstart(session):

tests/test_auth.py

@@ -190,10 +190,11 @@ class AuthApiTests(unittest.TestCase):
         reuse = self.client.post("/v1/auth/refresh", json={"refresh_token": refresh})
         self.assertEqual(reuse.status_code, 401)
 
+    @patch("netx_api.auth_service.settings.auth_single_session", True)
     def test_single_session_login_revokes_others(self) -> None:
         token = self._login()
         token2 = self._login()
-        # Default auth_single_session=True: first login is kicked.
+        # Single-session mode: first login is kicked.
         self.assertEqual(
             self.client.get("/v1/probe", headers={"Authorization": f"Bearer {token}"}).status_code,
             401,