Move the X-Test-Role-to-User promotion out of an inline
RequestDelegate and into a proper IMiddleware implementation,
wired through IStartupFilter so it lands after the production
UseAuthentication/UseAuthorization in the request pipeline.
The previous app.Use(...) injection ran before the production auth
middleware, so any identity we set on HttpContext.User was being
overwritten by the next middleware. Wrapping the production
pipeline in TestUserStartupFilter.Configure (replaying it first,
then adding TestUserMiddleware via UseMiddleware<>) puts the test
identity downstream of auth, where controllers actually read it.
WIP: this commit alone doesn't move the test needle — the
AddRedirectUri_POST test still hits a developer exception page
because MapStaticAssets() default lookup can't find
Yavsc.Org.Tests.staticwebassets.endpoints.json in the test bin.
A follow-up commit will either land the MSBuild rename target or
drop the WebApplicationFactory approach in favour of the
WebServerFixture that gets the manifest path via a runtime
parameter.
