feat(postit): circles+ACL UI, blog fixture→SQLite, seed default user

Bundled end-of-branch commit on feat/postit-acl-members.

PostIt UI for circles + per-post ACL
- Reorganise PostIt.Tests into Auth/ and Blogs/ subfolders
  (Bearer/OIDC scope tests vs. blog API fakes live where they
  belong) and introduces PostItHeadlessCollection so the
  Avalonia.Headless tests share a single xUnit collection
  instead of contending with the EF-Core test host.
- Adds BlogAclApiTests (a brand-new behavioural layer over
  POST /api/v1/blogacl) and the fakes it relies on
  (BlogApiTestFakes, BlogPostAuthorDtoTests, AddCircleMember
  DialogTests); pulls UserId-through-OIDC-sub path into
  BearerScopeTests / FakeAuthorizingBrowser /
  OidcStubAuthority.
- App.axaml.cs gets a small PushPageAsync touch-up the new
  tests rely on.
- Drops UnitTest1.cs (xUnit scaffold, never used).

Yavsc.Blogs.Tests — SQLite instead of InMemory
- Bumps Yavsc.Blogs.Tests.csproj on
  Microsoft.EntityFrameworkCore.Sqlite and rewrites
  BlogsWebServerFixture to hold a single shared
  SqliteConnection (Cache=Shared) for the fixture lifetime,
  with a sync Dispose close to dodge async teardown hangs.
  Reason: the EF Core InMemory provider silently ignores FKs,
  which masked the kind of bug we are about to pin in the
  ACL tests. SQLite enforces them, so any future INSERT that
  forgets to seed its parent rows fails loudly here instead
  of passing the test and breaking prod.
- PublishEndpointTests and BlogApiSmokeTests get a one-line
  tweak to follow the new connection lifecycle.

Foreign-key fallout: seed the default user in the fixture
- Adds BlogsWebServerFixture.SeedUser(userName). Now that
  SQLite enforces BlogPost.AuthorId → AspNetUsers.Id, every
  test that POST/PUT/DELETE a BlogPost and sends AuthorId=
  'tester' in the payload needs an AspNetUsers row to satisfy
  the FK or it returns 500 with SQLite Error 19.
- BlogApiTests wraps the existing ResetDatabase with a
  ResetAndSeedDefaultUser helper for the six mutating tests;
  the four GET-only and ModelState-only tests keep the bare
  ResetDatabase.
- Side benefit: every test in Yavsc.Blogs.Tests now finishes
  cleanly instead of hanging at teardown — previously a stuck
  test held the shared SqliteConnection open and the next
  tests waited indefinitely.

Verified: dotnet test src/Yavsc.Blogs.Tests passes 25/25
green from a clean run, no fixture teardown hang.

src/PostIt.Tests/BlogApiTestFakes.cs

@@ -1,66 +0,0 @@
-using Yavsc.Blogspot;
-using PostIt.Services;
-using PostIt.ViewModels;
-using Yavsc.Models;
-
-namespace PostIt.Tests;
-
-/// <summary>Per-call ledger shared between the test and the
-/// recording fake, so the assertion can inspect what the VM
-/// actually sent on the wire without coupling to the fake's
-/// internals.</summary>
-internal sealed class CallRecorder
-{
-    public (HttpMethod method, string path, object? body) FirstCall =>
-        Calls[0];
-    public List<(HttpMethod method, string path, object? body)> Calls { get; } = new();
-}
-
-/// <summary>Test fake that records every CallAsync invocation
-/// and answers them with a canned sequence: the first call gets
-/// a server-issued BlogPostDto (Id=42), the second call gets a
-/// single-element list containing that post. Used by the ViewModel
-/// tests and the headless UI test to capture exactly what the
-/// Save button posts to the server.</summary>
-internal sealed class RecordingYavscApiClient : YavscApiClient
-{
-    private readonly CallRecorder _recorder;
-    public RecordingYavscApiClient(CallRecorder recorder)
-        : base(
-            new Settings
-            {
-                Authentication = new AuthenticationSettings
-                {
-                    Authority = "https://stub.invalid",
-                    ClientId = "stub",
-                    Scopes = new[] { "openid" },
-                },
-            },
-            new TokenStore(System.IO.Path.GetTempFileName()))
-    {
-        _recorder = recorder;
-    }
-
-    public override Task<T> CallAsync<T>(HttpMethod method, string path, object? body = null, CancellationToken ct = default)
-    {
-        _recorder.Calls.Add((method, path, body));
-        // BlogPostDto? boxes to BlogPostDto at runtime, so we test the
-        // non-nullable type — typeof(BlogPostDto?) is a C# error
-        // (CS8639: "typeof cannot be used on a nullable reference
-        // type").
-        if (typeof(T) == typeof(BlogPostDto))
-            return Task.FromResult((T)(object)new BlogPostDto
-            {
-                Id = 42,
-                Title = "Mon premier billet",
-                AuthorId = "tester",
-                Article = "Contenu du billet de test.",
-            });
-        if (typeof(T) == typeof(List<BlogPostDto>))
-            return Task.FromResult((T)(object)new List<BlogPostDto>
-            {
-                new() { Id = 42, Title = "Mon premier billet" }
-            });
-        return Task.FromResult(default(T)!);
-    }
-}