Address review feedback: remove filter after dispatch, use empty caps

- Remove the get_user_metadata filter via rest_post_dispatch so it
  doesn't persist beyond the request.
- Return an empty capabilities array instead of subscriber role —
  is_array() passes without granting any real capabilities.
- Assert the application password is actually deleted in the test.
- Fix closure spacing per WordPress coding standards.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: obenland

settings/rest-api.php

@@ -496,6 +496,10 @@ function allow_application_password_management( $result, $server, $request ) {
 	}
 
 	add_filter( 'get_user_metadata', __NAMESPACE__ . '\treat_as_member_of_blog', 10, 3 );
+	add_filter( 'rest_post_dispatch', function( $response ) {
+		remove_filter( 'get_user_metadata', __NAMESPACE__ . '\treat_as_member_of_blog', 10 );
+		return $response;
+	} );
 
 	return $result;
 }
@@ -526,7 +530,8 @@ function treat_as_member_of_blog( $check, $user_id, $meta_key ) {
 	}
 
 	// Return a nested array: get_metadata() unwraps one level when $single is true.
-	return array( array( 'subscriber' => true ) );
+	// An empty capabilities array satisfies is_array() without granting any role.
+	return array( array() );
 }
 
 /**

tests/settings/test-application-passwords.php

@@ -170,7 +170,7 @@ public function test_non_member_can_revoke_application_password() : void {
 		);
 
 		// Remove the user from the current blog to simulate profiles.wordpress.org.
-		$remove_user_callback = function ( $check, $user_id, $meta_key ) {
+		$remove_user_callback = function( $check, $user_id, $meta_key ) {
 			global $wpdb;
 
 			if ( $user_id !== self::$regular_user->ID ) {
@@ -206,6 +206,15 @@ public function test_non_member_can_revoke_application_password() : void {
 		remove_filter( 'get_user_metadata', $remove_user_callback, 9 );
 
 		$this->assertSame( 200, $response->get_status(), 'Non-member should be able to revoke their own application password.' );
+
+		$remaining_passwords = WP_Application_Passwords::get_user_application_passwords( self::$regular_user->ID );
+		$remaining_uuids     = wp_list_pluck( $remaining_passwords, 'uuid' );
+
+		$this->assertNotContains(
+			$item['uuid'],
+			$remaining_uuids,
+			'Application password should be removed after revocation.'
+		);
 	}
 
 	/**