Add repository-level tests for admin protections and session revocation

[comwanga]

Context

PR #27 added protections around admin account management, including preventing unsafe self-actions, protecting the last active admin, and revoking sessions when an account is blocked.

This issue tracks that follow-up separately from the concurrency/TOCTOU work in #28.

What should be covered

Add focused repository-level tests for the behavior introduced in #27, particularly:

• An admin cannot perform a prohibited block/demotion action against their own account.
• The last active admin cannot be blocked or demoted when doing so would leave no active administrator.
• The operation is allowed when another eligible active admin remains.
• Blocking or deactivating a user revokes their existing sessions.
• A rejected operation does not leave partial account or session changes behind.

The tests should exercise the repository behavior directly rather than relying only on higher-level route or integration coverage.

Why this matters

These checks protect administrative access and session state. Having direct tests makes the intended behavior explicit and helps prevent a future repository refactor from weakening one of these protections while the broader test suite continues to pass.

Acceptance criteria

• Repository-level tests cover the self-admin protection introduced in fix: prevent blocked admins from retaining access #27.
• Repository-level tests cover the last-admin protection.
• Repository-level tests verify session revocation after the relevant account state change.
• Failure cases confirm that rejected operations do not partially mutate account or session state.
• Existing tests continue to pass.

Related: #27

Separate concurrency follow-up: #28