test: fix async fixture isolation, add fuzz marks, parallelize with xdist

- Rebuild repo.engine and repo.session_factory per-test using unique
  in-memory SQLite URIs — fixes KeyError: 'access_token' caused by
  stale session_factory pointing at production DB
- Add @pytest.mark.fuzz to all Hypothesis and Schemathesis tests;
  default run excludes them (addopts = -m 'not fuzz')
- Add missing fuzz tests to bounty, fleet, histogram, and repository
- Use tmp_path for state file in patch_state_file/mock_state_file to
  eliminate file-path race conditions under xdist parallelism
- Set default addopts: -v -q -x -n logical (26 tests in ~7s)

tests/api/fleet/test_get_deckies.py

@@ -1,6 +1,8 @@
 import pytest
 import httpx
+from hypothesis import given, settings, strategies as st
 from decnet.env import DECNET_ADMIN_USER, DECNET_ADMIN_PASSWORD
+from ..conftest import _FUZZ_SETTINGS
 
 @pytest.mark.anyio
 async def test_get_deckies_endpoint(mock_state_file, client: httpx.AsyncClient, auth_token: str):
@@ -10,3 +12,15 @@ async def test_get_deckies_endpoint(mock_state_file, client: httpx.AsyncClient,
     assert len(_data) == 2
     assert _data[0]["name"] == "test-decky-1"
     assert _data[0]["service_config"]["ssh"]["banner"] == "SSH-2.0-OpenSSH_8.9"
+
+@pytest.mark.fuzz
+@pytest.mark.anyio
+@settings(**_FUZZ_SETTINGS)
+@given(token=st.text(min_size=0, max_size=4096))
+async def test_fuzz_deckies_auth(client: httpx.AsyncClient, token: str) -> None:
+    """Fuzz the Authorization header on the deckies endpoint."""
+    try:
+        resp = await client.get("/api/v1/deckies", headers={"Authorization": f"Bearer {token}"})
+        assert resp.status_code in (200, 401, 422)
+    except (UnicodeEncodeError,):
+        pass