fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

features/verified_account_required.qa.md

@@ -58,14 +58,28 @@ routers, so the HTTP-level checks live in a new `test/verified_account_required_
 
 ## HTTP checks: an unresolvable caller still answers 401, not 403
 
-13. Table-driven over three token shapes, each against a fresh seed of user id 1,
+13. Table-driven over five token shapes, each against a fresh seed of user id 1,
     `IsVerified: false`, sent as `POST /v1/article/` with body
     `{"title":"Valid Title","body":"Some content"}`, asserting status `401` and body exactly
     `apperr.UnauthorizedErrorMessage`:
     - mint the jwt with `token.Encode(map[string]any{"role": "user"})` (no `user_id` key at all);
     - mint the jwt with `token.Encode(map[string]any{"user_id": "one"})` (string, not a number);
     - mint the jwt with `token.Encode(map[string]any{"user_id": uint32(999)})` (well-formed but no
-      such user in the repo).
+      such user in the repo);
+    - mint the jwt with `token.Encode(map[string]any{"user_id": -1.0})` (negative);
+    - mint the jwt with `token.Encode(map[string]any{"user_id": float64(4294967296)})` (one past
+      the uint32 maximum).
+13a. Seed `mockUserRepo` with user id 7, `IsVerified: true`; seed `mockArticleRepo` empty. Mint a
+    jwt with `token.Encode(map[string]any{"user_id": 7.5})` (a fractional value that would
+    previously have truncated to the real user id 7). `POST /v1/article/` with that cookie and body
+    `{"title":"Valid Title","body":"Some content"}` → assert status `401`, body exactly
+    `apperr.UnauthorizedErrorMessage`, and that the article repository gained no new article
+    (proving the fractional claim was rejected rather than silently accepted as user 7).
+13b. Extend `test/claims_test.go` with a `TestClaimsUserId` set of subtests mirroring the existing
+    `TestClaimsTokenVersion` pattern: a well-formed `uint32` claim returns `ok == true` with the
+    matching value; a missing key, a non-numeric value (string), a negative value, a fractional
+    value (e.g. `7.5`), and a value one past `math.MaxUint32` (`4294967296`) all return
+    `ok == false`. This exercises `claims.UserId` directly, independent of the HTTP round-trip.
 
 ## HTTP checks: no session at all is still 401