test(mcp): keep real mcp-auth.helpers in gate spec mock (forward-compat with #49)

After develop merged, mcp.service.ts calls decideBasicGate from mcp-auth.helpers.
The gate spec mocked the whole module returning only FailedLoginLimiter, so the
merged code crashed with 'decideBasicGate is not a function' (7/7 failing).
Spread jest.requireActual('./mcp-auth.helpers') so the real helpers are kept and
the gate exercises real logic; keep only FailedLoginLimiter stubbed so its
constructor runs without a real sweep timer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/server/src/integrations/mcp/mcp-basic-login-gate.spec.ts

@@ -72,14 +72,20 @@ jest.mock('@docmost/db/repos/user/user.repo', () => ({
 jest.mock('@docmost/db/repos/session/user-session.repo', () => ({
   UserSessionRepo: class UserSessionRepo {},
 }));
-// mcp-auth.helpers exports both runtime values (FailedLoginLimiter is used in
-// the constructor) and types. Provide a minimal FailedLoginLimiter so the
-// constructor runs; everything else the gate path doesn't need.
-jest.mock('./mcp-auth.helpers', () => ({
-  FailedLoginLimiter: class FailedLoginLimiter {
-    sweep() {}
-  },
-}));
+// mcp-auth.helpers exports runtime values the gate relies on (decideBasicGate,
+// mapAuthResultToResponse, etc.). Keep the REAL helpers so the gate exercises
+// real logic; only stub FailedLoginLimiter so its constructor runs without a
+// real sweep timer. The module is framework-free and loads cleanly under jest
+// (mcp.service.spec.ts already imports it directly), so requireActual is safe.
+jest.mock('./mcp-auth.helpers', () => {
+  const actual = jest.requireActual('./mcp-auth.helpers');
+  return {
+    ...actual,
+    FailedLoginLimiter: class FailedLoginLimiter {
+      sweep() {}
+    },
+  };
+});
 
 // Import AFTER the mocks are registered.
 // eslint-disable-next-line @typescript-eslint/no-require-imports