Fix the timing-dependent failures the faster backend tests expose #9039

Running the forge unit tests in parallel and with faster app boots exposes three timing-dependent failures:

1. The auth spec takes the latest audit entry by createdAt. Two entries written in the same millisecond tie, so it can pick the wrong one.
2. The device group spec expects members in a fixed order, but DeviceGroup.byId doesn't order them.
3. Two simultaneous MCP refresh token requests can both lose the compare-and-swap on the rotation, so neither gets a token.