[dantro86]

Summary

Extend the API-token regression suite with owner isolation between two disposable non-admin accounts.

Four independent invocations cover two contracts through both cookie and Bearer authentication:

• Each user lists only their own token, with the public prefix, correct owner ID and name.
• Deleting another user's token prefix leaves both credentials listed and usable. The rightful owner can still revoke that same token.

The current DELETE contract returns idempotent HTTP 204 for a foreign prefix. The tests therefore verify persisted state and authentication, not just the response status.

Implementation

• Seed-scoped account data stays in token fixtures; a precondition creates users and registers cleanup.
• Token cleanup retains the creating session and runs before user deletion.
• Omit token-list HTTP response bodies from reports, including behind a subpath, so a server regression exposing full tokens cannot publish them in attachments.
• Add fixture-isolation and report-safety self-tests; update the typed TestStore architecture contract.
• Update the plan, README and changelog.

Validation

• ./gradlew spotlessApply qualityGate — passed.
• All nine token cases (four new, five existing) — 9/9 passed on core-sqlite-local.
• The same suite — 9/9 passed on core-postgres-local.
• Both profiles used the same locally built application image at develop@11bb5955a5995570f4b4b03106c847942a311108.
• Final formatting, changelog and diff checks — passed.

These are targeted runs, not full-profile reruns. No owner-isolation defect was observed.

Scope

No new CI job or external environment is required. Live expiry, password-change effects, prefix collisions and admin impersonation are outside this block. Existing nightly Chromium/SSH/LDAP failures are not changed here.