test(org): isolate in-memory store per fixture

TestWebApplicationFactory instances shared the same in-memory database
because EF Core's UseInMemoryDatabase("InMemory") returns the same
backing store to every DbContext that asks for it under the same
connection string, in the same process. Whichever fixture started
first defined the state, and every subsequent fixture inherited it,
making tests silently order-dependent and flaky.

Fix:

- Yavsc.Tests.Shared/InMemoryDatabaseName: helper that suffixes the
  in-memory connection string with a per-fixture GUID.
- TestWebApplicationFactory: instance GUID + ConnectionStrings__
  YavscConnection set as an environment variable in the constructor
  and cleared in Dispose, so each factory gets its own backing store.
  Env var is needed because IdentityServer8.EntityFramework exposes
  ConfigureDbContext as Action<DbContextOptionsBuilder> with no
  service-provider access, so the connection string is captured at
  registration time. AddEnvironmentVariables is the last provider in
  the config pipeline and wins regardless.
- WebServerFixture: process-static GUID (WebHostFixture is a
  per-process singleton by design, so the test collection shares one
  store; the GUID still isolates from TestWebApplicationFactory).
- AddIdentityDBAndStores: read the connection string at DbContext
  construction time via the (sp, options) overload of AddDbContext,
  so test fixtures can override it via the host's IConfiguration.
  IdentityServer stores cannot do the same without subclassing the
  framework's DbContexts; the env var path is the documented escape
  hatch in HostingExtensions.AddIdentityServer.
- UsesInMemoryProvider: StartsWith instead of equality, so
  'InMemory-{guid}' is still recognised as an in-memory connection
  string.

Regression sentinel in
Controllers/TestWebApplicationFactoryIsolationTests: two factories
seed a marker client in the first, the second must not see it.

Suite: 45/45 over 3 stable runs, 13-15s each.

src/Yavsc.Org.Tests/Controllers/TestWebApplicationFactoryIsolationTests.cs

@@ -0,0 +1,68 @@
+using IdentityServer8.EntityFramework.DbContexts;
+using IdentityServer8.EntityFramework.Entities;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Yavsc.Org.Tests.Controllers;
+
+/// <summary>
+/// Regression sentinel: two <see cref="TestWebApplicationFactory"/>
+/// instances must not see each other's clients.
+///
+/// EF Core's <c>UseInMemoryDatabase(name)</c> returns the same
+/// backing store to every <c>DbContext</c> that asks for it under
+/// the same name, in the same process. Before the per-fixture GUID
+/// fix, both <see cref="TestWebApplicationFactory"/> and
+/// <see cref="WebServerFixture"/> used the bare <c>"InMemory"</c>
+/// connection string, so every fixture shared one store and tests
+/// were silently order-dependent.
+///
+/// We assert against <see cref="ConfigurationDbContext"/> directly
+/// rather than via <c>IClientStore</c>: the validating wrapper around
+/// <c>IClientStore</c> raises events through <c>IEventService</c>,
+/// which is not registered in the test host and crashes with a
+/// <c>NullReferenceException</c> before it can return a result. Going
+/// straight to the DbContext is the same code path the production
+/// code uses, so it is the right surface to assert against.
+/// </summary>
+public class TestWebApplicationFactoryIsolationTests
+{
+    [Fact]
+    public async Task Second_factory_does_not_see_clients_seeded_into_first()
+    {
+        var marker = $"marker-A-{Guid.NewGuid():N}";
+
+        // First factory: seed a distinctive client.
+        using (var first = new TestWebApplicationFactory())
+        {
+            await using var scope = first.Services.CreateAsyncScope();
+            var configDb = scope.ServiceProvider.GetRequiredService<ConfigurationDbContext>();
+            var firstCs = scope.ServiceProvider.GetRequiredService<IConfiguration>()
+                .GetConnectionString("YavscConnection");
+            Assert.StartsWith("InMemory-", firstCs);
+            configDb.Clients.Add(new Client { ClientId = marker, ClientName = "marker-A" });
+            await configDb.SaveChangesAsync(TestContext.Current.CancellationToken);
+
+            // Sanity: the first factory can see its own seed.
+            var seenByFirst = await configDb.Clients
+                .AsNoTracking()
+                .AnyAsync(c => c.ClientId == marker, TestContext.Current.CancellationToken);
+            Assert.True(seenByFirst);
+        }
+
+        // Second factory: must start from a clean slate. If the
+        // in-memory store leaked from the first factory, this
+        // assertion fails.
+        using var second = new TestWebApplicationFactory();
+        await using var secondScope = second.Services.CreateAsyncScope();
+        var secondCs = secondScope.ServiceProvider.GetRequiredService<IConfiguration>()
+            .GetConnectionString("YavscConnection");
+        Assert.StartsWith("InMemory-", secondCs);
+        var secondDb = secondScope.ServiceProvider.GetRequiredService<ConfigurationDbContext>();
+        var seenBySecond = await secondDb.Clients
+            .AsNoTracking()
+            .AnyAsync(c => c.ClientId == marker, TestContext.Current.CancellationToken);
+        Assert.False(seenBySecond);
+    }
+}