test(client): open the ① probe on login, the way the card's own probe opens

The card's end-to-end probe is `login -> enable -> verifyTotp -> disable ->
deleteUser`. The suite opened on the registration that had to precede that
login, which is the same credential state by construction but not the same
line. Spell the first step as the card spells it: a real second sign-in whose
echoed token the SDK stores, asserted against the stored credential before
the sequence continues.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

Author: claude

packages/client/src/auth-rotated-session-token.test.ts

@@ -282,7 +282,16 @@ describe("#16534 ① the card's own probe, with the manual re-set deleted", () =
   it('login → enable → verifyTotp → disable → deleteUser, no hand-repaired credential', async () => {
     const { engine, manager, client, email } = await signedIn();
     const userId = await userIdFor(engine, email);
+
+    // ── the probe's FIRST step, spelled the way the card spells it. The card's
+    //    sequence opens on `login`, not on the registration that had to precede
+    //    it, so this opens on `login` too — a real second sign-in whose token
+    //    the SDK stores, which is the line the card measured verbatim:
+    //    `client.auth.login({ email, password }) -> RESOLVED { token, user }`.
+    const session = await client.auth.login({ email, password: PASSWORD });
+    expect(session?.data?.token, 'login echoed no token').toBeTruthy();
     const afterLogin = String(storedToken(client));
+    expect(afterLogin, 'login did not store the token it was handed').toBe(session.data?.token);
 
     // The premise. Without it a green run could not tell "the rotation is
     // followed now" from "the bearer seam never worked here".