Replace the remaining private MockDatabaseInterface/FakeServer copies in the forced-password, room-channel, movecard, and random-reveal tests with InMemoryServer_DatabaseInterface and ServerTestFixture. The room-channel test keeps its log assertions against the shared logEntries; the forced-password test seeds its moderator user and auth result through the fixture knobs. Delete movecard_tests/server_test_helpers.h.
checkUserPassword ignored force_password_change on the challenge-response
path, so a reset password stayed valid. Returning PasswordChangeRequired
was not enough on its own: the session was dropped and the client told the
user to ask the administrator for the temporary password they had just used.
The pending session now keeps its identity without registering a user
session or announcing a join, may only ping and change its password, and
the client completes the change in-session before reconnecting.
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
