Pin selfhosted directory modes in the authz sweep

The sweep exercises usb/employees handlers, which default to EXTERNAL
directory mode when no setting row exists - green on the dev box where
the external MySQL databases happen to exist, red in CI where they do
not. Seed selfhosted mode in an autouse fixture so the guard is
deterministic everywhere. Verified by running the suite with the
external DB hosts pointed at an unreachable address.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_core/test_authz.py

@@ -40,6 +40,20 @@ EXEMPT_BLUEPRINTS = {'auth', 'collector', 'setup'}
 EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user'}
 
 
+@pytest.fixture(autouse=True)
+def _selfhosted_directory_modes(db):
+    # The usb/employees plugins default to EXTERNAL directory mode when no
+    # setting row exists, so exercising their handlers reaches for a MySQL
+    # server that exists on the dev box but not in CI. Pin selfhosted mode
+    # so the sweep is deterministic everywhere.
+    from shopdb.core.models import Setting
+    db.session.add(Setting(key='usb_directory_mode', value='selfhosted',
+                           valuetype='string', category='site'))
+    db.session.add(Setting(key='employee_directory_mode', value='selfhosted',
+                           valuetype='string', category='site'))
+    db.session.commit()
+
+
 def _fill_url(rule):
     """Turn a Werkzeug rule into a concrete path (int/float params -> 1, else x)."""
     def repl(match):