Fix post-deploy auth issues: best-effort service provisioning, integration test auth, test mock corrections

- api/app.py: email/calendar/files provisioning now best-effort (non-fatal); fixed email_manager.create_email_user call to include domain argument
- tests/integration: added module-level auth sessions to all integration test files; added admin auth to api fixture and _resolve_admin_pass() helper; added TEST_PEER_PASSWORD constant; added password to peer creation calls
- tests/test_peer_provisioning.py: renamed rollback test to reflect new best-effort semantics (email failure no longer causes rollback)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration/test_containers.py

@@ -19,7 +19,7 @@ import requests
 import sys
 import os
 sys.path.insert(0, os.path.dirname(__file__))
-from conftest import API_BASE
+from conftest import API_BASE, _resolve_admin_pass
 
 # A non-critical container safe to restart during testing.
 # cell-ntp has no write-side effects and recovers in seconds.
@@ -29,12 +29,24 @@ _SAFE_TO_RESTART = 'cell-ntp'
 _NONEXISTENT = 'cell-does-not-exist-xyz'
 
 
+
+_S = None
+
+@pytest.fixture(scope='module', autouse=True)
+def _auth_session():
+    global _S
+    _S = requests.Session()
+    _S.headers['Content-Type'] = 'application/json'
+    r = _S.post(f"{API_BASE}/api/auth/login",
+                json={'username': 'admin', 'password': _resolve_admin_pass()})
+    assert r.status_code == 200, f"Login failed: {{r.text}}"
+
 def get(path, **kw):
-    return requests.get(f"{API_BASE}{path}", **kw)
+    return _S.get(f"{API_BASE}{path}", **kw)
 
 
 def post(path, **kw):
-    return requests.post(f"{API_BASE}{path}", **kw)
+    return _S.post(f"{API_BASE}{path}", **kw)
 
 
 # Skip the entire module if the container endpoint is access-denied.
@@ -42,7 +54,7 @@ def post(path, **kw):
 # is_local_request().  Run `make update` to rebuild and re-enable these tests.
 def _containers_accessible():
     try:
-        return requests.get(f"{API_BASE}/api/containers", timeout=3).status_code != 403
+        return _S.get(f"{API_BASE}/api/containers", timeout=3).status_code != 403
     except Exception:
         return False