test: use-case coverage + end-to-end smoke test

- tests/test_coven.py: capacity cap (5th rejected, configurable), duplicate
  username, roster frame contents, slot/username freed on disconnect.
- tests/conftest.py: set app.ctx.max_users (fixes fixture vs new server code).
- hh/smoke.sh: one-command e2e — rust unit tests, SRP self-test, boot server,
  rust handshake round-trip, cross-language python decrypt of a rust message.
- hh: drop unused Session.user_id (clean build).

pytest: 85 passed. smoke: PASS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hh/src/net.rs

@@ -17,7 +17,6 @@ use tokio_tungstenite::{MaybeTlsStream, WebSocketStream};
 type Ws = WebSocketStream<MaybeTlsStream<TcpStream>>;
 
 pub struct Session {
-    pub user_id: String,
     pub username: String,
     pub room: Arc<fernet::Fernet>,
     pub ws_url: String,
@@ -79,7 +78,6 @@ pub fn authenticate(
         format!("{ws_scheme}://{ip}:{port}/ws/chat?user_id={user_id}&ws_token={ws_token}");
 
     Ok(Session {
-        user_id,
         username: user.to_string(),
         room: Arc::new(fernet),
         ws_url,