acl post: never 500 regression sentinel + async CheckOwner + fixture seed

The hard rule on POST /api/v1/blogacl is: a 500 is never acceptable,
regardless of the payload shape. The prod 500 logged on 2026-08-21 on
mercure was caused by the PostIt client sending { circleId } only, which
the server deserialised into CircleAuthorizationToBlogPost with
BlogPostId = default(long) = 0; EF Core refused the INSERT with
InvalidOperationException: The value of
'CircleAuthorizationToBlogPost.BlogPostId' is unknown. The PostIt fix
lives in b82b6722 (enrich the payload with blogPostId). The server-side
guard lives in this commit:

- BlogAclApiController.CheckOwner is now async and uses FirstOrDefaultAsync
  instead of First, so it does not deadlock the request thread and
  returns false on a missing circle (which the controller already maps
  to ChallengeResult).
- BlogsWebServerFixture now seeds Alice, her Circle and her BlogPost
  in ConfigurePipelineAsync, once at host startup, against the shared
  SqliteConnection (Cache=Shared). EnsureCreated is idempotent and
  runs against the connection that every DbContext resolves through,
  so the test theory can POST payloads with real FK ids against a
  schema that actually has the Circle / BlogSpot tables.
- BlogAclApiTests:
    - PostCircleAuthorization_returns_201_when_payload_mirrors_PostIt_shape
      is the regression sentinel for the prod fix.
    - PostCircleAuthorization_never_returns_500 is a [Theory] over
      several payload shapes; any future commit that reintroduces a
      500 path turns it red. CleanupAcl at the start of each insert-
      bearing test isolates against xUnit's no-guarantee-of-order
      execution: a successful POST in test N would otherwise conflict
      with test N+1 against the same (CircleId, BlogPostId) pair.

src/Yavsc.Blogs.Tests/BlogsWebServerFixture.cs

@@ -200,6 +200,66 @@ public sealed class BlogsWebServerFixture : WebHostFixture
         app.UseAuthentication();
         app.UseAuthorization();
         app.MapControllers();
+
+        // EnsureCreated + seed alice, run once at host startup.
+        // EnsureCreated is idempotent (creates only the tables that
+        // don't exist yet) and runs against the shared
+        // SqliteConnection (Cache=Shared), so every DbContext that
+        // resolves through this fixture's host sees the same schema.
+        // We do NOT call EnsureDeleted: the SqliteConnection is held
+        // open at the static level and closing it destroys the
+        // :memory: store for every other DbContext — the org
+        // fixture can afford EnsureDeleted because its store is
+        // built fresh per fixture, but the blogs fixture's static
+        // connection outlives a single fixture instance.
+        using (var seedScope = app.Services.CreateScope())
+        {
+            var db = seedScope.ServiceProvider
+                .GetRequiredService<ApplicationDbContext>();
+            db.Database.EnsureCreated();
+            if (!db.Users.Any(u => u.Id == "alice"))
+            {
+                db.Users.Add(new ApplicationUser
+                {
+                    Id = "alice",
+                    UserName = "alice",
+                    Email = "alice@example.com",
+                    EmailConfirmed = true,
+                    FullName = "Alice Dupont",
+                    Avatar = "/avatars/alice.png",
+                });
+                db.SaveChanges();
+
+                // Inline the seed of the circle + post. We don't
+                // call SeedCircle/SeedBlogPost (the instance helpers)
+                // because those resolve through this.Services, which
+                // is null until WebHostFixture.InitializeAsync has
+                // finished wiring the shared slot — i.e. after this
+                // method returns. Use app.Services directly.
+                var circle = new Circle
+                {
+                    OwnerId = "alice",
+                    Name = "test",
+                    Public = true,
+                };
+                db.Circle.Add(circle);
+                db.SaveChanges();
+                CircleId = circle.Id;
+
+                var post = new BlogPost
+                {
+                    AuthorId = "alice",
+                    Title = "Billet ACL test",
+                    Article = "Test article body.",
+                    DateCreated = DateTime.UtcNow,
+                    DateModified = DateTime.UtcNow,
+                };
+                db.BlogSpot.Add(post);
+                db.SaveChanges();
+                PostId = post.Id;
+            }
+        }
+
         await Task.CompletedTask;
         return app;
     }
@@ -288,30 +348,6 @@ public sealed class BlogsWebServerFixture : WebHostFixture
 
 
 
-    /// <summary>Reset the in-memory database and seed <c>alice</c>.
-    /// The shared SQLite <c>:memory:</c> store persists across
-    /// requests, so each test starts from a clean slate.</summary>
-    private void ResetDatabaseWithAlice()
-    {
-        using var scope = Services.CreateScope();
-        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
-        db.Database.EnsureDeleted();
-        db.Database.EnsureCreated();
-
-        db.Users.Add(new ApplicationUser
-        {
-            Id = "alice",
-            UserName = "alice",
-            Email = "alice@example.com",
-            EmailConfirmed = true,
-            FullName = "Alice Dupont",
-            Avatar = "/avatars/alice.png",
-        });
-        db.SaveChanges();
-        CircleId = SeedCircle("alice", "test", isPublic: true);
-        PostId = SeedBlogPost("alice", "Billet ACL test");
-    }
-
     /// <summary>Create a circle owned by <paramref name="ownerId"/>
     /// directly in the SQLite store and return its server-assigned
     /// id.</summary>