bug: tests/test_subscriptions.py wipes every subscription on its target instance and leaves auto-switch OFF — the API integration suite is destructive to a real Trinity #2420

Summary

The API integration suites under tests/ are destructive to whatever instance they are pointed at, and they point at http://localhost:8000 by default (TRINITY_API_URL, see tests/conftest.py) — i.e. a developer's live local Trinity, not only CI's ephemeral stack:

• tests/test_subscriptions.py — test_create_agent_no_subscriptions does GET /api/subscriptions and then DELETEs every subscription on the instance ("Clear ALL subscriptions first to ensure clean state"), not only the ones the suite created. delete_subscription cascades agent_ownership.subscription_id → NULL, so every agent on the instance silently falls back to API-key auth.
• tests/test_subscription_auto_switch.py — test_auto_switch_setting_toggle_cycle cycles the setting [True, False, True, False] and test_…_can_disable ends on enabled=false; neither restores the pre-test value, so the instance is left with auto-switch OFF.

Context

Running these three suites (test_subscriptions.py, test_subscription_auto_switch.py, test_subscription_usage.py) against a developer instance on 2026-08-27 deleted the developer's real subscriptions mid-session, dropped all four agents to API-key auth, and disabled auto-switch — with no trace in the audit log, because subscription mutations are not audited (companion issue filed separately). Recovery required copying the subscription_credentials rows back from /data/backups/; one subscription registered after the last backup was unrecoverable.

The suites are correct for the disposable stack CI boots and for /verify-local's isolated sibling stack; the hazard is that nothing distinguishes a disposable target from a real one, and the default target is the developer's own instance.

Acceptance Criteria

• No test deletes a subscription it did not create: the "clean state" step deletes only subscriptions whose name carries the suite's own prefix (e.g. test-), or creates its precondition differently (a dedicated fixture instead of a wipe)
• Every test that toggles auto_switch_subscriptions (or any other platform setting) reads the value first and restores it in a finally/fixture teardown, so the target's configuration is unchanged after the run
• The shared test client refuses to run mutating suites unless TRINITY_TEST_ALLOW_DESTRUCTIVE=1 is set (skip with a message naming the variable), so pointing the suite at a real instance is an explicit act
• tests/README (or the /verify-local guidance) states that tests/test_*.py mutate their target and names the disposable-stack path
• A test pins the guard (the suite skips without the variable)

Technical Notes

• tests/test_subscriptions.py — the wipe loop is in test_create_agent_no_subscriptions (helper block around _cleanup_subscription); the same file's other deletes are correctly scoped to ids the tests created
• tests/test_subscription_auto_switch.py — test_auto_switch_setting_toggle_cycle, test_auto_switch_setting_can_disable
• The default target is set in the shared test client (TRINITY_API_URL → http://localhost:8000, documented in tests/conftest.py)
• Related: the companion audit-coverage bug for routers/subscriptions.py