test: address Open SWE review — xfail the web_ui non-ASCII auth pin, document subset coverage-floor override

- tests/test_web_ui_auth.py: replace the TypeError characterization pin with an
  xfail(strict, raises=TypeError) asserting the DESIRED fail-closed (False)
  behavior. Documents the intended fix and auto-fails (xpass) once web_ui_auth is
  corrected, instead of requiring a passing test to be knowingly deleted. The
  module stays frozen this phase; the underlying hmac.compare_digest ASCII-only
  defect is tracked as a follow-up.
- pytest.ini: document that the aggregate 80% floor (enforced in CI via the
  reusable workflow's bare pytest) red-exits local subset runs by design, with the
  --cov-fail-under=0 override for iteration. Floor stays in addopts because the
  centralized ci-python-sam workflow exposes no per-run test command.

pytest.ini

@@ -15,3 +15,10 @@ addopts =
     --cov=lambdas/shared
     --cov-report=term-missing
     --cov-fail-under=80
+; The 80% floor is an aggregate whole-suite gate, enforced in CI by the
+; reusable ci-python-sam workflow's bare `pytest` run (which inherits these
+; addopts). Because the floor is inherited by every invocation, running a
+; single root or file for local iteration (e.g. `pytest tests/test_web_ui_auth.py`)
+; under-measures the fixed --cov set and red-exits even when the selected tests
+; pass. That is expected: append `--cov-fail-under=0` (or `-p no:cov`) to a
+; subset run to skip the floor while iterating. The full-suite run still gates.

tests/test_web_ui_auth.py

@@ -105,11 +105,16 @@ def test_header_matrix(load_auth, monkeypatch, headers, expected):
     assert mod.is_authenticated(_evt(**headers)) is expected
 
 
-def test_non_ascii_token_raises_typeerror_documenting_pin(load_auth, monkeypatch):
-    """PIN (current behavior, fix deferred -- module frozen this phase): a
-    non-ASCII presented token makes hmac.compare_digest raise TypeError (surfaces
-    as a 500 today). Locked so a future fix is a deliberate, reviewed change."""
+@pytest.mark.xfail(
+    strict=True,
+    reason="web_ui_auth is frozen this phase: is_authenticated raises TypeError on "
+    "a non-ASCII presented token (hmac.compare_digest is ASCII-only) and surfaces "
+    "as a 500 instead of failing closed to False. Asserting the DESIRED behavior "
+    "under xfail(strict) documents the intended fix and auto-fails (xpass) the moment "
+    "the module is corrected, forcing the marker's removal. Tracked as a follow-up.",
+    raises=TypeError,
+)
+def test_non_ascii_token_should_fail_closed(load_auth, monkeypatch):
     mod = load_auth()
     monkeypatch.setattr(mod, "_get_auth_token", lambda: "SECRET")
-    with pytest.raises(TypeError):
-        mod.is_authenticated(_evt(**{"x-auth-token": "SÉCRET"}))
+    assert mod.is_authenticated(_evt(**{"x-auth-token": "SÉCRET"})) is False