fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

test/reset_password_test.go

@@ -164,22 +164,4 @@ func TestResetPasswordUseCase(t *testing.T) {
 		}
 	})
 
-	t.Run("The generic reset-code update stores an empty code as empty instead of hashing it", func(t *testing.T) {
-		repo := newMockUserRepo()
-		repo.users[3] = user.User{ID: 3, Email: "alice@example.com"}
-		hasher := &stubHasher{}
-		uc := useCases.NewUpdateUserUseCase(repo, hasher)
-
-		_, err := uc.UpdatePasswordResetCode(3, "", time.Time{})
-
-		if err != nil {
-			t.Fatalf("expected no error, got %v", err)
-		}
-		if hasher.hashCalls != 0 {
-			t.Errorf("expected Hash to never be called, got %d calls", hasher.hashCalls)
-		}
-		if repo.users[3].PasswordResetCode != "" {
-			t.Errorf("expected stored PasswordResetCode to be empty, got %q", repo.users[3].PasswordResetCode)
-		}
-	})
 }