ensureAuth() probes an auth-required endpoint after each login() and re-logs-in
if the session hasn't settled (occasionally needed under slowMo after rapid
role swaps). Also observes the HTTP status of every second-pass POST so any
auth bounce is visible. App logic unchanged (verified via the test client).