a04eb3a752
Under DisableLogin /auth/token deliberately answers 404 (lane K). The tests now probe it: on a login-disabled rig TokenEndpoint_ReturnsJwt skips and the bad-credentials test asserts 404 (the exchange is closed); with login enabled they keep the 200 + JWT and 401 assertions.