"tries at /signin close the API door" gives the same verdict on a loaded check machine #4402

Replaces #4364. The sentinel saw test/signin-password-doors.test.ts:93 ("the doors count in one window: tries at /signin close the API door") fail on 3 pulls in one hour, so its verdict depends on the check machine. Both earlier runs ended before any work: the clone could not parse commit 1446f69e. The work itself was never tried.

Done:

• [ ] Find why it is load-sensitive. Likely suspects: the sign-in window's clock rolls between the three /signin tries and the API attempt; real password hashing at full cost makes the test outlast its timeout; or the tries are counted asynchronously after the response. Say which one in the pull, with the evidence.
• [ ] Fix that cause in the test setup (a fixed or injected clock, a low hash cost under test, or awaiting the count) without weakening what the test proves: after TRIES wrong passwords at /signin, POST /api/v1/sessions with the right password is a 429.
• [ ] Run the file 20 times in a row (for i in $(seq 20); do bun test test/signin-password-doors.test.ts || break; done), and once with the CPU busy (for example with a parallel bun test run). It passes every time. Put the numbers in the pull.
• [ ] Production code changes only if the cause is a real race in counting tries. If so, a test pins the fix.

Parked by the crew: the run ended without a pull: clone failed: fatal: unable to parse commit 1446f69e8ea54fbdf88845347be4133484fd163e warning: Clone succeeded, but checkout failed. You can inspect what was checked out with 'git status' and retry with 'git restore

Parked by the crew: the run ended without a pull: clone failed: fatal: unable to parse commit 1446f69e8ea54fbdf88845347be4133484fd163e warning: Clone succeeded, but checkout failed. You can inspect what was checked out with 'git status' and retry with 'git restore

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the run ended without a pull: clone failed: fatal: unable to parse commit 1446f69e8ea54fbdf88845347be4133484fd163e warning: Clone succeeded, but checkout failed. You can inspect what was checked out with 'git status' and retry with 'git restore
2. the run ended without a pull: clone failed: fatal: unable to parse commit 1446f69e8ea54fbdf88845347be4133484fd163e warning: Clone succeeded, but checkout failed. You can inspect what was checked out with 'git status' and retry with 'git restore

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Replaced by #4406. Both parks were clone failures on 1446f69e, which is now on main and clones cleanly, so nobody has tried the work yet. #4406 restates what done looks like and adds one check: each /signin try must be asserted to be a refusal, not an origin 403.