tests: the self-revoke routing check reads the URL map; its 400 moves to Postgres

test_devices signed a fake account into a session and relied on
login_required answering without the database. Since 3dd0b44 the session
path reads the account's epoch, so the fake account hit an unreachable
database and 500ed. The routing property (the static /devices/self rule beats
/devices/<device_id>) is now asserted on the URL map, and the view's 400 for a
web session is an integration test with a real account. #5173.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_integration.py

@@ -1170,3 +1170,12 @@ async def test_a_short_password_leaves_the_reset_link_usable(app_client, db):
     assert short.status_code == 400
     ok = await client.post("/api/auth/reset-password", json={"token": token, "password": "a-brand-new-password"})
     assert ok.status_code == 200
+
+
+async def test_revoking_this_device_from_a_web_session_is_a_bad_request(app_client, db):
+    """A session-cookie caller holds no device token, so "revoke the one I'm using"
+    has nothing to name. Moved here from the unit lane when the session check began
+    reading the account (#5173)."""
+    await _signed_in(app_client, "web")
+    resp = await app_client.delete("/api/auth/devices/self")
+    assert resp.status_code == 400