refactor(tests): one definition each for the copied fixtures and fakes (#2825, milestone 296 area 1)

The shape ledger showed the same test scaffolding defined over and over:
_bind_user x12 (byte-identical), _dispose_engine x10 in three wordings,
_no_supersession x3, _make_mock_session x7 in three subsets, a get-or-create
User helper x2 (+3 inlined), and fifteen hand-rolled MagicMock note factories
each re-explaining the same "an auto-MagicMock attribute is truthy" hazard
(note 2109).

Now: conftest.py carries _bind_user / _dispose_engine / _no_supersession as
opt-in fixtures (pytestmark = usefixtures(...) per module, so unit tests pay
nothing), and tests/helpers.py carries make_mock_session(), ensure_user() and
fake_note(**attrs) — the hazard documented once, real values on every
attribute the product reads. Call sites were rewritten by AST so titles with
dashes and commas survived; the three SimpleNamespace _note stand-ins that
only feed a single function stay local.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_services_systems.py

@@ -2,16 +2,7 @@
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
-
-
-def _make_mock_session():
-    s = AsyncMock()
-    s.__aenter__ = AsyncMock(return_value=s)
-    s.__aexit__ = AsyncMock(return_value=False)
-    s.add = MagicMock()
-    s.commit = AsyncMock()
-    s.refresh = AsyncMock()
-    return s
+from tests.helpers import make_mock_session
 
 
 @pytest.mark.asyncio
@@ -25,7 +16,7 @@ async def test_create_system_denied_without_project_write():
 
 @pytest.mark.asyncio
 async def test_create_system_sets_fields_when_authorized():
-    mock_session = _make_mock_session()
+    mock_session = make_mock_session()
     captured = {}
 
     def _capture_add(obj):