test(auth): assert the cookie path returns the derived authMethod

The cookie arm of requireAuth now carries authMethod: "cookie" alongside the
session payload, so the exact-shape assertion expects it.

src/app/api/measurements/batch/__tests__/sync-trigger.test.ts

@@ -244,16 +244,14 @@ describe("POST /api/measurements/batch — syncTrigger diagnostic (iOS #66)", ()
     // sample row inserts. The per-row outcome must be identical regardless of
     // whether `syncTrigger` rides the request.
     const seedExisting = () =>
-      vi
-        .mocked(prisma.measurement.findMany)
-        .mockResolvedValue([
-          {
-            id: "m1",
-            type: "ACTIVITY_STEPS",
-            source: "APPLE_HEALTH",
-            externalId: STATS_ID,
-          },
-        ] as never);
+      vi.mocked(prisma.measurement.findMany).mockResolvedValue([
+        {
+          id: "m1",
+          type: "ACTIVITY_STEPS",
+          source: "APPLE_HEALTH",
+          externalId: STATS_ID,
+        },
+      ] as never);
 
     const entries = [sampleEntry(SAMPLE_ID, 64), stepsEntry(STATS_ID, 5000)];
 

src/lib/__tests__/require-auth-bearer.test.ts

@@ -390,7 +390,8 @@ describe("requireAuth — cookie path remains intact", () => {
 
     const ctx = await requireAuth("medication:ingest");
 
-    expect(ctx).toEqual(cookieSession);
+    // The cookie path carries the session payload plus the derived transport.
+    expect(ctx).toEqual({ ...cookieSession, authMethod: "cookie" });
     // Cookie short-circuits before any token logic runs.
     expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
     expect(hashToken).not.toHaveBeenCalled();