feat(activity-log): phase 3 - event instrumentation (4 categories)

- entity CRUD via fire_entity_event choke point (name resolved/sanitized; deletes pass name explicitly)
- auth: failures + WS session establishment (no tokens logged); per-IP audit-record throttle
- device: online/offline (health), discovered/lost (zeroconf), ADB connect/disconnect
- capture/system: target start-stop, scenes, playlists, automations, backup/restore, update, restart, calibration, settings
- security hardening: sanitize_display strips control/NUL/ANSI/newlines from untrusted strings; malformed-IPv6 origin guard
- 129 instrumentation tests (incl. secret-leak, log-injection, throttle, best-effort) + autouse throttle-reset fixture

server/tests/conftest.py

@@ -285,6 +285,34 @@ def sample_calibration():
     }
 
 
+# ---------------------------------------------------------------------------
+# Auth throttle isolation — reset per-IP throttle state between every test
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture(autouse=True)
+def _reset_auth_throttle():
+    """Clear the auth-failure audit throttle dict before (and after) each test.
+
+    The module-global ``_auth_record_last`` dict in ``ledgrab.api.auth`` persists
+    across tests.  When multiple tests trigger an auth failure from the SAME
+    client IP within the 10 s window they share, the second test gets throttled
+    (0 records) and assertions like "expected exactly 1 auth.rejected" fail.
+
+    This fixture resets the dict to a clean state so every test starts with a
+    fresh throttle window.  The production throttle behavior is UNCHANGED — only
+    test isolation is affected.
+    """
+    import ledgrab.api.auth as _auth_mod
+
+    _throttle = getattr(_auth_mod, "_auth_record_last", None)
+    if _throttle is not None:
+        _throttle.clear()
+    yield
+    if _throttle is not None:
+        _throttle.clear()
+
+
 # ---------------------------------------------------------------------------
 # Session cleanup — remove temporary test directory
 # ---------------------------------------------------------------------------