test(auth): mint session fixtures in the shape the lookup accepts

The session time-zone test stored sessions under readable secrets that
the cookie shape check now refuses before the query, so it tested the
refusal instead of the expiry. A shared helper mints hls_ plus 32 hex
bytes, and the two route tests that set a session cookie use it too.

src/__tests__/helpers/session-secret.ts

@@ -0,0 +1,11 @@
+/**
+ * A session cookie secret of the exact shape `createSession` mints (`hls_`
+ * and 32 random bytes in hex). The session lookup refuses any other shape
+ * before it asks the database, so a fixture that invents a readable secret
+ * tests the refusal, not the lookup.
+ */
+import { randomBytes } from "node:crypto";
+
+export function fixtureSessionSecret(): string {
+  return `hls_${randomBytes(32).toString("hex")}`;
+}

src/app/api/auth/native/complete/__tests__/route.test.ts

@@ -45,6 +45,7 @@ import { GET } from "../route";
 import { checkAuthSurfaceRateLimit } from "@/lib/rate-limit";
 import { mintNativeHandoff } from "@/lib/auth/native-handoff";
 import { prisma } from "@/lib/db";
+import { fixtureSessionSecret } from "@/__tests__/helpers/session-secret";
 import {
   NATIVE_HANDOFF_STATE_COOKIE,
   encodeNativeHandoffState,
@@ -71,7 +72,7 @@ function makeRequest(opts: {
     );
   }
   if (opts.withSession !== false) {
-    r.cookies.set("healthlog_session", "hls_sessionsecret");
+    r.cookies.set("healthlog_session", fixtureSessionSecret());
   }
   return r;
 }

src/app/api/auth/oidc/callback/__tests__/route.test.ts

@@ -101,6 +101,7 @@ import {
   verifyIdToken,
 } from "@/lib/auth/oidc";
 import { mintNativeHandoff } from "@/lib/auth/oidc-native-handoff";
+import { fixtureSessionSecret } from "@/__tests__/helpers/session-secret";
 
 const CONFIG = {
   issuerUrl: "https://idp.example.com",
@@ -616,7 +617,8 @@ describe("GET /api/auth/oidc/callback — duplicate-callback idempotency", () =>
     const req = new NextRequest(
       "http://localhost/api/auth/oidc/callback?code=abc&state=STATE",
     );
-    if (withSession) req.cookies.set("healthlog_session", "hls_valid_secret");
+    if (withSession)
+      req.cookies.set("healthlog_session", fixtureSessionSecret());
     return req;
   }