test(08-03): promote CR-01/CR-02/CR-03 session-revocation tests from xfail to passing

- Remove @pytest.mark.xfail decorator from test_change_password_revokes_other_sessions (CR-01)
- Remove @pytest.mark.xfail decorator from test_enable_totp_revokes_other_sessions (CR-02)
- Remove @pytest.mark.xfail decorator from test_disable_totp_revokes_other_sessions (CR-03)
- All three tests now show PASSED (not XPASS) in strict pytest runs

backend/tests/test_auth.py

@@ -169,7 +169,6 @@ async def _try_refresh(
 # ── Tests ─────────────────────────────────────────────────────────────────────
 
 
-@pytest.mark.xfail(reason="Wave 0 stub — promoted to passing in 08-03", strict=False)
 @pytest.mark.asyncio
 async def test_change_password_revokes_other_sessions(revoke_client, db_session):
     """CR-01: change_password revokes other sessions; current session preserved.
@@ -214,7 +213,6 @@ async def test_change_password_revokes_other_sessions(revoke_client, db_session)
     assert status_b == 401, f"Session B refresh should be revoked (401), got {status_b}"
 
 
-@pytest.mark.xfail(reason="Wave 0 stub — promoted to passing in 08-03", strict=False)
 @pytest.mark.asyncio
 async def test_enable_totp_revokes_other_sessions(revoke_client, db_session):
     """CR-02: enable_totp revokes other sessions; current session preserved.
@@ -268,7 +266,6 @@ async def test_enable_totp_revokes_other_sessions(revoke_client, db_session):
     assert status_b == 401, f"Session B refresh should be revoked (401), got {status_b}"
 
 
-@pytest.mark.xfail(reason="Wave 0 stub — promoted to passing in 08-03", strict=False)
 @pytest.mark.asyncio
 async def test_disable_totp_revokes_other_sessions(revoke_client, db_session):
     """CR-03: disable_totp revokes other sessions; current session preserved.