A test pins sign-in through another forge: a login in flight is taken once and expires, and a parent link is one per account and issuer #6798

src/core/federation.ts (#748) keeps sign-ins in flight as hashed state; no test calls startLogin, takeLogin, linkedAccount, linkParent, unlinkParent or parentIssuerOf directly.

Done when a new test file proves, passing now in:

• [ ] a started login is returned by takeLogin once with its stored fields; a second take is undefined; a take after its lifetime is undefined; an unknown state is undefined.
• [ ] the raw state is not stored in the table (only its hash).
• [ ] linkParent then linkedAccount(issuer, sub) finds the account; linking the same issuer and sub to a second account behaves as the module documents; unlinkParent removes it.
• [ ] parentIssuerOf reads the configured parent and is undefined without one.

Test only; a bug it finds is fixed in the same pull.