refactor(backend-2fa): split the 6,300-line test module into discoverable suites

[rudeus112266]

Summary

backend-2fa/src/tests.rs was a single 6,363-line file mixing enrollment, verification, recovery, admin, rate-limiting, and integration tests together (plus ~15 ad-hoc nested test modules with inconsistent boundaries), making it hard to navigate, parallelize, or assign ownership of.

Split it into backend-2fa/src/tests/{enrollment,verification,recovery,rate_limit,admin,integration}.rs, organized by domain as requested. Shared test fixtures that were previously duplicated across several originally-separate nested modules (caller, generate_token, admin, MockRedisState, mock_record_failure, RecordingHttpClient, etc.) are hoisted once into a new tests/common.rs, glob-imported by all six domain files.

Scope

Pure structural reorganization — no test logic, assertions, or production code changed. Domain classification was done with a script (name/section-based, cross-checked against the original file's own section comments) and mechanically verified: every one of the 260 original #[test]/#[tokio::test]/#[actix_web::test] functions is preserved in exactly one output file — counted before and after and confirmed to match exactly, so nothing was lost, duplicated, or silently dropped.

One incidental fix (disclosed)

While verifying the split actually compiles, I found test_tenant_scoped_disable_does_not_affect_other_tenant reuses a moved token_a without .clone() — a pre-existing bug in the original tests.rs (verified byte-identical in git show upstream/main:backend-2fa/src/tests.rs, not introduced by this split) that blocks the whole crate from compiling in test configuration. Fixed with a single .clone() since otherwise this PR's own claim of "tests still compile" couldn't be verified at all. No other test bodies were touched.

Testing

• cargo test -p petchain-2fa --lib --no-run: after the split, only the same pre-existing, unrelated compile errors remain as on upstream/main before this change (missing enroll_lock field on TwoFactorHandlers, TenantScopedStore not implementing TwoFactorStore, a missing test_two_factor_store helper) — confirmed by diffing the error set before/after; this PR introduces zero new compile errors. upstream/main does not currently compile its test target at all (independent of this PR), so "all tests pass" isn't achievable until that's fixed separately.
• rustfmt --check on all 8 new/changed files: clean.
• cargo clippy --all-targets: halts on the same pre-existing lib errors as upstream/main, so no new clippy findings could be introduced by this diff either.
• Exact-count check: grep -c '#\[test\]\|#\[tokio::test\]\|#\[actix_web::test\]' on the original file vs. the sum across all 6 new files: 260 = 260.

Threat model

None — this is a test-only file reorganization with no production code, storage, ABI, or authorization changes.

Closes #1219

[drips-wave]

@rudeus112266 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits