Refactor auth tests to use real communities, remove mocks

[neuromechanist]

Summary

• Remove all MagicMock, @patch, and patch.dict from authorization tests
• Load real community configs via discover_assistants() at module level
• Use monkeypatch.setenv/delenv for environment variable control (not mocking; real Settings reads them)
• Add _clear_settings_cache autouse fixture to clear @lru_cache between tests
• Test against real community CORS origins (HED, MNE, EEGLAB, BIDS)
• Add test_cross_community_origins_not_shared for isolation verification
• All 29 original test scenarios preserved and passing

Test plan

• All 29 auth tests pass
• Zero mock imports remaining in file
• Pre-commit hooks pass (ruff lint + format)

Closes #85

[neuromechanist]

PR Review

Code review found 2 important issues, both addressed in follow-up commit:

1. Hardcoded config values violate testing guidelines (confidence: 85) - Values like CORS origins and default_model were hardcoded. Project guidelines say "Dynamic tests: Query registries/configs, don't hardcode values." Fixed by adding helper functions (_get_config, _get_exact_origin, _get_wildcard_origin) that derive test data from loaded community configs.

2. discover_assistants() at module level (confidence: 80) - Called during test collection, making failures confusing. Fixed by moving to a module-scoped autouse fixture for proper error reporting.

Test coverage review: All critical authorization paths covered (29 tests). Minor gaps identified (empty cors_origins path, community_config=None in select_api_key) are low severity (4-5/10) and the behavior is straightforward in those paths.