fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

features/hasher_domain_interface.feature

@@ -14,8 +14,9 @@ Feature: Password and code hashing go through a domain Hasher interface
       existing user.ErrUserNotFound
     And internal/infrastructure/hashing.BcryptHasher implements hash.Hasher and is asserted
       with var _ hash.Hasher = &BcryptHasher{}
-    And api/dependecyInjection.go constructs one BcryptHasher and passes it to
-      CreateUserUseCase, UpdateUserUseCase and the new AuthenticateUserUseCase
+    And api/dependecyInjection.go constructs one BcryptHasher and passes it to every use case
+      that hashes or compares a secret: CreateUserUseCase, AuthenticateUserUseCase,
+      VerifyUserUseCase, RequestPasswordResetUseCase and ResetPasswordUseCase
     And UserRepository.Create, UpdatePassword and UpdatePasswordResetCode store the string
       they are given verbatim and never call bcrypt
     And the auth Handler no longer imports golang.org/x/crypto/bcrypt; Login calls
@@ -37,27 +38,6 @@ Feature: Password and code hashing go through a domain Hasher interface
     Then the use case returns that error
     And the repository's Create is never called
 
-  Scenario Outline: Updating a password or a password reset code stores the hashed value
-    Given a fake hasher that hashes any value "x" to "hashed:x"
-    When UpdateUserUseCase.<Method> is called with user id 1 and "<plaintext>"
-    Then the repository's <Method> is called with "hashed:<plaintext>", not "<plaintext>"
-
-    Examples:
-      | Method                  | plaintext      |
-      | UpdatePassword          | newPassw0rd    |
-      | UpdatePasswordResetCode | reset-code-123 |
-
-  Scenario Outline: A hashing failure during an update persists nothing
-    Given a fake hasher whose Hash always returns an error
-    When UpdateUserUseCase.<Method> is called with user id 1 and "<plaintext>"
-    Then the use case returns that error
-    And the repository's <Method> is never called
-
-    Examples:
-      | Method                  | plaintext      |
-      | UpdatePassword          | newPassw0rd    |
-      | UpdatePasswordResetCode | reset-code-123 |
-
   Scenario: Authenticating with the correct password returns the user
     Given a user repository containing a user "alice" with stored password "hashed:hunter2example"
     And a fake hasher whose Compare returns nil when given "hashed:hunter2example" and "hunter2example"