test: isolate session fixtures from developer project credentials

tests/conftest.py

@@ -4,6 +4,7 @@ import pytest
 
 @pytest.fixture(autouse=True)
 def isolated_user_credentials(monkeypatch, tmp_path):
+    monkeypatch.chdir(tmp_path)
     monkeypatch.setenv("NAPSEER_USER_DATA_DIR", str(tmp_path / "user-data"))
-    for name in ("NAPSEER_API_KEY", "NAPSEER_TOKEN", "NAPSEER_REFRESH_TOKEN"):
+    for name in ("NAPSEER_API_KEY", "NAPSEER_TOKEN", "NAPSEER_REFRESH_TOKEN", "NAPSEER_AUTH_FILE", "NAPSEER_PROJECT_ROOT", "NAPSEER_PROJECT_ID", "NAPSEER_BASE_URL"):
         monkeypatch.delenv(name, raising=False)

tests/test_gateway_relay_auth.py

@@ -15,6 +15,8 @@ def load_module():
 
 def test_renew_auth_serializes_rotating_refresh_tokens():
     mod = load_module()
+    mod.TOKEN = "synthetic-configured-access"
+    mod.REFRESH_TOKEN = "synthetic-configured-refresh"
     active = 0
     maximum = 0
     guard = threading.Lock()

tests/test_mcp_worker_lifecycle.py

@@ -166,6 +166,7 @@ def test_mutating_tools_are_serialized_while_reads_can_overlap(monkeypatch):
 
 def test_concurrent_first_reads_share_one_project_bootstrap(tmp_path, monkeypatch):
     mod = load_module()
+    mod.TOKEN = "synthetic-configured-access"
     mod.AUTH_PATH = tmp_path / "missing-auth.json"
     mod.DEFAULT_PROJECT_ID = None
     monkeypatch.setattr(mod, "refresh_public_auth_state", lambda: None)