Adds @AfterEach to delete the test users so Testcontainers reuse does not leak an authenticated user with a future token_revoked_before into the shared schema (visible to LicenseUsageReader.snapshot, user-admin listing tests, etc.). Adds unrevokedUserTokenIsAccepted to pin the revoked == null no-op branch as a first-class assertion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>