test(withings): scope the expired-nonce assertion to the token URL

The expired-nonce callback test asserted the global fetch spy was never
called. A preceding successful-connection test fires its webhook
subscriptions fire-and-forget, and those promises resolve into the next
test's freshly installed spy, so the broad assertion failed whenever the
background calls landed in time. Filter the recorded calls to the token
endpoint and assert none reached it, matching the replay and cross-user
tests in the same file and keeping the check true to its intent.

tests/integration/withings-oauth-flow.test.ts

@@ -270,8 +270,15 @@ describe("Withings OAuth nonce ledger (real Postgres)", () => {
       "withings=error&reason=expired",
     );
 
-    // Token endpoint never hit.
-    expect(fetchSpy).not.toHaveBeenCalled();
+    // Token endpoint never hit. Scope the assertion to the token URL so a
+    // prior connection's fire-and-forget webhook subscriptions, which resolve
+    // asynchronously into this spy, cannot make the check flaky.
+    const tokenCalls = fetchSpy.mock.calls.filter(
+      ([input]) =>
+        (typeof input === "string" ? input : (input as Request).url) ===
+        WITHINGS_TOKEN_URL,
+    );
+    expect(tokenCalls).toHaveLength(0);
 
     // The handler stamps out the expired row so a clock-skewed replay
     // can't slip through.