test: clear SonarCloud security false positives in new tests

The new-code quality gate flagged test-only mock fixtures as security issues
(new_security_rating E):
- S2068 "hard-coded password" ×2: drop the unused "app_password" value from the
  get_app_password_with_scopes mocks (the code under test only reads truthiness
  + "scopes").
- S6418 "hard-coded token": NOSONAR on the Login Flow v2 poll-token test fixture.
- S5443 "publicly writable directory": NOSONAR on the /tmp debug screenshot path
  (matches this file's existing convention).

No behaviour change; all are test fixtures, not real credentials.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/test_astrolabe_multi_user_background_sync.py

@@ -129,7 +129,7 @@ async def enable_background_sync(page: Page, username: str) -> bool:
         logger.info("✓ Background indexing enabled for %s", username)
         return True
     except Exception:
-        screenshot_path = f"/tmp/astrolabe_enable_failed_{username}.png"
+        screenshot_path = f"/tmp/astrolabe_enable_failed_{username}.png"  # NOSONAR: test debug artifact, matches this file's convention
         await page.screenshot(path=screenshot_path)
         raise ValueError(
             f"Background indexing did not enable for {username}. "