Every test that calls init_auth() now holds AUTH_LOCK for its full duration, preventing the global AUTH_CONTEXT from being overwritten by concurrent tests. The e2e_auth_failure_wrong_token test additionally resets auth back to "devtoken" after its assertion. Tests now pass reliably with default parallelism (no --test-threads 1 required).