Backfill coverage gaps found in the 2026-06-17 code review

[travis-sauer-oltech]

Background

Code review of the 2026-06-17 work surfaced small test-coverage gaps deliberately kept out of the original PRs to keep them reviewable.

Context / Checklist

• Write tests and docs for multi-client support feature #293 (test_client_viewset.py): study clients DELETE path; consolidated_clients isolation (a client from an unrelated study is excluded) + the patient_invitations enrichment; a non-superuser 403 on a mutating client endpoint (PATCH/DELETE/data_sources).
• Support US Core query modifiers #585 (test_fhir_search_common_params.py): gt/lt comparators; a bare-date value (whole day); the aux/UUID _id routing path. Also fix the misleading comment in apply_common_search_filters (it is the camelCase MIDDLEWARE, not the parser, that rewrites query keys).
• Expose patient User ID (jheUserID, not patient id) in the FHIR Observation API output #602 (test_fhir_observation_subject_identifier.py): assert FHIR validity in the no-jhe_user case; assert subject.identifier per entry in a multi-observation search Bundle.
• Make Observation.data_source optional in the Django admin (null in DB but form-required) #603 (test_observation_admin.py): admin POST save-path - save an Observation with data_source blank and assert it persists (not just that the form field is optional).

Acceptance Criteria

• Each checklist item has a passing test (and the Support US Core query modifiers #585 comment is corrected).