fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

test/request_password_reset_http_test.go

@@ -172,6 +172,8 @@ func TestRequestPasswordResetHTTP(t *testing.T) {
 		mailRepo.fail.failNext("Send")
 		router := newRequestPasswordResetRouter(userRepo, mailRepo, "https://cms.example.com")
 
+		logBuf := captureRequestPasswordResetLog(t)
+
 		recorder := sendPasswordResetRequest(router, `{"email": "alice@example.com"}`)
 
 		if recorder.Code != http.StatusOK {
@@ -183,6 +185,12 @@ func TestRequestPasswordResetHTTP(t *testing.T) {
 		if recorder.Header().Get("Set-Cookie") != "" {
 			t.Errorf("expected no jwt cookie to be set, got %s", recorder.Header().Get("Set-Cookie"))
 		}
+		if logBuf.Len() == 0 {
+			t.Fatalf("expected a failure to be written to the process log")
+		}
+		if !strings.Contains(strings.ToLower(logBuf.String()), "send") && !strings.Contains(strings.ToLower(logBuf.String()), "mail") {
+			t.Errorf("expected the log to name the mail-send failure, got %q", logBuf.String())
+		}
 	})
 
 	t.Run("An unverified user can request a password reset exactly like a verified one", func(t *testing.T) {