fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

api/pkg/claims/claims.go

@@ -1,6 +1,7 @@
 package claims
 
 import (
+	"math"
 	"net/http"
 
 	"github.com/go-chi/jwtauth/v5"
@@ -22,6 +23,10 @@ func UserId(r *http.Request) (uint32, bool) {
 		return 0, false
 	}
 
+	if userIdFloat < 0 || userIdFloat > math.MaxUint32 || userIdFloat != math.Trunc(userIdFloat) {
+		return 0, false
+	}
+
 	return uint32(userIdFloat), true
 }