fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

features/hasher_domain_interface.qa.md

@@ -23,12 +23,6 @@ Package: `test` (black-box, alongside the existing `article_test.go` / `user_tes
    UUID, unchanged from current behaviour).
 4. Same use case with `fakeHasher` configured to always error on `Hash`: assert
    `CreateUser` returns that error and `fakeRepo.Create` was never called.
-5. `useCases.NewUpdateUserUseCase(fakeRepo, fakeHasher)`, call `UpdatePassword(1,
-   "newPassw0rd")` and separately `UpdatePasswordResetCode(1, "reset-code-123")`: assert the
-   fake repo receives `"hashed:newPassw0rd"` / `"hashed:reset-code-123"`, not the plaintext.
-6. Same two methods with `fakeHasher.Hash` erroring: assert the use case returns the error
-   and the corresponding fake-repo method (`UpdatePassword` / `UpdatePasswordResetCode`) was
-   never called.
 7. `useCases.NewAuthenticateUserUseCase(fakeRepo, fakeHasher)` (new use case): seed
    `fakeRepo` with a user "alice" whose stored `Password` is `"hashed:hunter2example"`.
    - `Authenticate("alice", "hunter2example")` with `fakeHasher.Compare` returning `nil` →