Test resolve_scope / account_scope (auth on vs off)

[ShauryaaSharma]

Carried over from lorehasit/Lore-test-extension-#22 (open, not yet covered by the new test suite).

Problem

Scoping decides who can read what. Bugs here either leak data across accounts or hide a user's own Canon. The new suite (tests/test_auth.py) covers key creation/resolution/revocation, but not app/auth/scope.py::resolve_scope or app/retrieval/canon.py::account_scope directly.

What to do

Add tests/test_scope.py covering:

• Auth off + LORE_DEFAULT_ACCOUNT set: user_id="demo" resolves to gh:<default>.
• Auth off, no default: demo stays demo.
• Auth on: a valid key resolves to its own account scope; user_id is ignored even if it names a different account.
• Auth on: missing/invalid key returns the (None, "missing or invalid Lore API key", None) tuple.
• account_scope() lowercases the login and prefixes gh:.

Definition of done

• All cases above pass in tests/test_scope.py, run against the real Postgres test fixture already in tests/conftest.py.

Files

• new tests/test_scope.py; exercises app/auth/scope.py::resolve_scope, app/retrieval/canon.py::account_scope