Same inline-assert smoke-test pattern the rest of ci.yml already
uses, not a new pytest dependency — matches the existing style. Covers
exactly what was manually verified ad-hoc while building each feature
tonight, now codified so it doesn't regress silently: RFC 4226 TOTP
vectors, node reorder + its validation, a real backup-then-mutate-
then-restore round trip, multi-admin create/delete-last-refusal, and
rate-limit counter accumulation/clearing.
Verified by extracting the exact embedded script and running it
locally end-to-end before committing — CI itself is still not
triggering runs on this account (separate, already-reported GitHub-side
issue, see memory), so this was the only way to actually confirm it
passes rather than hoping.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
