Fix CI failures: test isolation, collection limit, APIDeleteAPIKey auth

- Drop collections (not just delete documents) in test cleanup — prevents
  duplicate key errors on MigrateToMultiUser and stops Atlas collection
  accumulation that hit the 500-collection free-tier limit
- Add middleware.InjectAPIUser helper for injecting auth context in tests
- Update TestAPIDeleteAPIKey to inject admin user context (delete requires auth)
- Drop 27 stale collections from abandoned test databases on Atlas

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jonradoff

internal/handlers/api_test.go

@@ -7,6 +7,9 @@ import (
 	"strings"
 	"testing"
 
+	"lightcms/internal/auth"
+	"lightcms/internal/middleware"
+
 	"github.com/gorilla/mux"
 )
 
@@ -522,10 +525,14 @@ func TestAPIDeleteAPIKey(t *testing.T) {
 	ah, _, cleanup := newTestAPIHandler(t)
 	defer cleanup()
 
-	// Create first
+	// Inject an admin user so the delete handler can determine key ownership
+	adminUser := &auth.SessionUser{ID: "000000000000000000000001", Email: "admin@test", Role: "admin"}
+
+	// Create first (as admin)
 	createRR := httptest.NewRecorder()
 	createReq := httptest.NewRequest(http.MethodPost, "/api/v1/api-keys", strings.NewReader(`{"name":"del-key"}`))
 	createReq.Header.Set("Content-Type", "application/json")
+	createReq = createReq.WithContext(middleware.InjectAPIUser(createReq.Context(), adminUser))
 	ah.APICreateAPIKey(createRR, createReq)
 
 	var created map[string]interface{}
@@ -540,6 +547,7 @@ func TestAPIDeleteAPIKey(t *testing.T) {
 
 	rr := httptest.NewRecorder()
 	req := httptest.NewRequest(http.MethodDelete, "/api/v1/api-keys/"+id, nil)
+	req = req.WithContext(middleware.InjectAPIUser(req.Context(), adminUser))
 	router.ServeHTTP(rr, req)
 
 	if rr.Code != http.StatusOK {

internal/handlers/testhelper_test.go

@@ -89,8 +89,11 @@ func testDB(t *testing.T) *database.DB {
 	return sharedTestDB
 }
 
-// cleanupCollections removes all documents from test collections for isolation.
-// Deletes are issued in parallel to minimise Atlas round-trip overhead.
+// cleanupCollections drops test collections for isolation.
+// Dropping (rather than just deleting documents) ensures indexes are also cleared,
+// preventing duplicate key errors on re-creation and avoiding Atlas collection
+// accumulation when tests use unique indexes (e.g. users.email).
+// Drops are issued in parallel to minimise Atlas round-trip overhead.
 func cleanupCollections(t *testing.T, db *database.DB) {
 	t.Helper()
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
@@ -102,13 +105,12 @@ func cleanupCollections(t *testing.T, db *database.DB) {
 		"snippets", "users", "audit_logs", "contact_messages", "login_attempts",
 		"oauth_clients", "user_activity",
 	}
-	empty := bson.M{}
 	var wg sync.WaitGroup
 	for _, name := range collections {
 		wg.Add(1)
 		go func(col string) {
 			defer wg.Done()
-			db.Collection(col).DeleteMany(ctx, empty)
+			db.Collection(col).Drop(ctx) //nolint:errcheck
 		}(name)
 	}
 	wg.Wait()

internal/middleware/apiauth.go

@@ -29,6 +29,12 @@ func APIUserFromContext(ctx context.Context) (interface{}, bool) {
 	return user, user != nil
 }
 
+// InjectAPIUser returns a context with the given user injected as the API user.
+// Intended for use in tests only.
+func InjectAPIUser(ctx context.Context, user interface{}) context.Context {
+	return context.WithValue(ctx, apiUserContextKey, user)
+}
+
 // SessionValidateFunc validates a session cookie and returns the authenticated user (as interface{}).
 // It receives the full HTTP request so it can read cookies.
 type SessionValidateFunc func(r *http.Request) interface{}