test(auth): pin the passthrough test's key URL like the env deployment it simulates

Author: nmgarza5

backend/tests/external_dependency_unit/auth/test_jwt_passthrough.py

@@ -138,10 +138,17 @@ def _reset_key_cache() -> Any:
 
 
 def _point_at(monkeypatch: pytest.MonkeyPatch, url: str) -> None:
-    # Both modules read the shared security settings at call time.
+    # Both modules read the shared security settings at call time. The URL is
+    # treated as env-pinned, matching the env-configured deployment this test
+    # simulates, so the local plain-http JWKS server stays fetchable.
     settings = _build_env_defaults().model_copy(update={"jwt_public_key_url": url})
     monkeypatch.setattr(jwt_module, "get_security_settings", lambda: settings)
     monkeypatch.setattr(users_module, "get_security_settings", lambda: settings)
+    monkeypatch.setattr(
+        jwt_module,
+        "env_pinned_active_fields",
+        lambda: frozenset({"jwt_public_key_url"}),
+    )
 
 
 async def _authenticate(token: str) -> User | None: