refactor: extract WebHostFixture + TestAuthPolicyProvider to shared lib

Yavsc.Blogs.Tests will need a fixture too. Lifting the cross-cutting
plumbing (Kestrel + self-signed cert + address discovery + lazy init)
into a new Yavsc.Tests.Shared project lets the next fixture inherit
from it without copying 200+ lines of setup boilerplate, and keeps
the Org.Tests fixture focused on its IdentityServer + SMTP seed.

* New project src/Yavsc.Tests.Shared with WebHostFixture (abstract)
  and TestAuthPolicyProvider (test auth bypass via X-Test-Role).
* WebServerFixture in Org.Tests now inherits from WebHostFixture;
  BuildApp + ConfigurePipelineAsync hold only Org-specific work.
* Two shared package versions promoted to the root Directory.Packages.props.
* Tests still 30/30 green.

src/Yavsc.Org.Tests/Yavsc.Org.Tests.csproj

@@ -46,6 +46,7 @@
     <ProjectReference Include="..\Yavsc.Org\Yavsc.Org.csproj" />
     <ProjectReference Include="..\Yavsc.Abstract\Yavsc.Abstract.csproj" />
     <ProjectReference Include="..\Yavsc.Server\Yavsc.Server.csproj" />
+    <ProjectReference Include="..\Yavsc.Tests.Shared\Yavsc.Tests.Shared.csproj" />
   </ItemGroup>
   <ItemGroup>
     <Using Include="Xunit" />