test(api): stop tests leaking module mocks and env into later files

CI failed on a different set of tests each run because bun runs every test
file in one process and the file order differs between machines:

- the secretsmanager route test replaced the whole ../aws module, so files
  loaded after it lost awsClients, lambda and defaultAccountId (API Gateway,
  SES)
- the Lightsail tests restored FLOCI_ENDPOINT by assigning undefined, which
  stores the string "undefined" (runtime diagnostics)
- the auth tests used full-strength argon2 for ~30 sign-ins and timed out on
  slower runners; the OIDC cleanup test cached a discovery document without
  userinfo_endpoint for the shared issuer

Checked with 20 runs under bun test --randomize.

packages/api/src/routes/secretsmanager.test.ts

@@ -1,13 +1,16 @@
 import {beforeEach, describe, expect, mock, test} from 'bun:test'
 
 // The secretsmanager router imports the `secretsManager` singleton directly from
-// `../aws`, so we replace that module with a stub whose `send()` is driven per
-// test. `responder` returns the fake AWS SDK response and `lastCommand` captures
+// `../aws`, so we replace that export with a stub whose `send()` is driven per
+// test. Bun keeps a module mock for the rest of the run, so every other export
+// stays real: test files that load `../aws` after this one still get it whole. `responder` returns the fake AWS SDK response and `lastCommand` captures
 // the command that was dispatched so we can assert on its input shape.
 let lastCommand: {constructor: {name: string}; input: Record<string, unknown>} | null = null
 let responder: (commandName: string, command: {input: Record<string, unknown>}) => unknown
 
+const realAws = await import('../aws')
 mock.module('../aws', () => ({
+    ...realAws,
     secretsManager: {
         async send(command: {constructor: {name: string}; input: Record<string, unknown>}) {
             lastCommand = command