feat(tests): scaffold Yavsc.Blogs.Tests with BlogsWebServerFixture

Adds the test project that the next commit will use to assert the
blog API endpoints. The fixture inherits from the shared
WebHostFixture (commit "refactor: extract WebHostFixture…") and
wires up only the bits the blog API needs:

* In-memory ApplicationDbContext — BlogSpotService is used as-is,
  no mock. The first tests will exercise the real service against
  an empty table.
* Trivial IFileSystemAuthManager stub (the GET index path never
  reads the file system).
* TestAuthPolicyProvider swapped in, so X-Test-Role satisfies
  [Authorize("BlogScope")].

Two smoke tests verify the fixture boots and the controller
pipeline is reachable. The first behavioural test
(GET /api/v1/blog → 200) lands in the next commit.

Also promotes two xunit.v3.* package versions to the root
Directory.Packages.props so future test projects can share them.

src/Yavsc.Blogs.Tests/BlogApiSmokeTests.cs

@@ -0,0 +1,42 @@
+using System.Net;
+using System.Net.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Blogs.Tests;
+
+/// <summary>
+/// Smoke tests for the Yavsc.Blogs API host. These tests only assert
+/// that the fixture boots and the test HTTP client reaches the
+/// controller pipeline — they do not yet exercise the controller
+/// surface. The first behavioural test (GET /api/v1/blog returns
+/// 200) lands in a follow-up commit.
+/// </summary>
+public sealed class BlogApiSmokeTests : IClassFixture<BlogsWebServerFixture>
+{
+    private readonly BlogsWebServerFixture _fixture;
+
+    public BlogApiSmokeTests(BlogsWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    [Fact]
+    public void Fixture_Binds_At_Least_One_Https_Address()
+    {
+        Assert.NotEmpty(_fixture.Addresses);
+        Assert.Contains(_fixture.Addresses, a => a.StartsWith("https://"));
+    }
+
+    [Fact]
+    public void Fixture_Exposes_Resolving_ServiceProvider()
+    {
+        // If the host built correctly, the service provider should
+        // be available and resolvable. We don't need to assert a
+        // specific service here — the GET 200 test will exercise
+        // the BlogSpotService indirectly.
+        Assert.NotNull(_fixture.Services);
+        using var scope = _fixture.Services.CreateScope();
+        Assert.NotNull(scope.ServiceProvider);
+    }
+}