test: shared LiveServerCase fixture replaces 21 hand-rolled harnesses

[gorevds]

What

Every integration class hand-rolled the same setUpClass: tempdir, websh.json write, WEBSH_CONFIG export, config-cache reset, creds-file plumbing, module-global monkeypatching, server-on-port-0 + thread + flat sleep(0.2), mirrored teardown — plus per-class urlopen helpers re-implementing the same JSON dance.

One declarative base now carries all of it:

class TestApiSave(LiveServerCase):
    CONFIG = {...}          # written as websh.json, caches reset around the class
    ENV = {...}             # extra os.environ for the class duration
    GLOBALS = {"WEBSH_VAULT_ENABLE": True}   # snapshotted + restored
    CREDS = {...}           # creds file (CREDS_PATH for path-only)

Genuinely unique bits stay as small overrides: the E2E ssh/tmux probe (START_SERVER=False), the AAD-bound creds-blob generation, and thin helper-signature shims where tests call legacy shapes.

Numbers

• −530 lines (+266/−796)
• Suite faster: 28.6s → 24.6s — readiness is an /api/ping poll in 10 ms steps instead of 21 flat sleeps (/api/ping consumes no rate-limit token — verified)
• 486 test IDs byte-identical to the pre-refactor verbose run (diff empty), same single skip

Coverage preserved, not weakened (adversarial review)

• JSON parsing stays strict by default: every old per-class helper ERROR'd if an API response wasn't JSON — that implicit contract survives, so a stdlib HTML send_error leaking out still fails ~42 tests that don't assert on the body. The two vault classes that historically asserted on a {"_raw": ...} fallback opt in via TOLERANT_JSON = True.
• Globals restore is exact (snapshot without defaults — a typo'd name fails loudly in setUpClass); verified no test method relies on class teardown for its own global mutations.
• The concurrency class keeps its deliberate timeout=10.
• No cross-class leakage: teardown cache resets are stricter than the old fixtures; CONFIG=None classes match the old bare-server fixtures exactly (load_config returns _CONFIG_EMPTY before consulting the cache when WEBSH_CONFIG is unset).

Tests

python3 test_server.py: 486 OK (skipped=1), 3 consecutive green runs.