test: keep environment changes from leaking between tests; stub Redis in the bearer test

Several tests set NO_LOAD_GRAPH_DB (admin_authz_hardening, admin_runtime_settings) or the
librarian promoted defaults (evaluate_harness) process-wide and never restored them, so
later db_test gap-analysis and parser tests failed in CI. The bearer test hit Redis,
which CI does not have.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: northdpole

application/tests/admin_authz_hardening_test.py

@@ -4,6 +4,7 @@
 
 import os
 import unittest
+from unittest import mock
 from unittest.mock import patch
 
 from application import create_app, sqla
@@ -12,8 +13,11 @@
 
 class TestAdminAuthzHardening(unittest.TestCase):
     def setUp(self) -> None:
-        os.environ["NO_LOAD_GRAPH_DB"] = "1"
-        os.environ["INSECURE_REQUESTS"] = "1"
+        patcher = mock.patch.dict(
+            os.environ, {"NO_LOAD_GRAPH_DB": "1", "INSECURE_REQUESTS": "1"}
+        )
+        patcher.start()
+        self.addCleanup(patcher.stop)
         self.app = create_app(mode="test")
         self.app.secret_key = "test-secret"
         self.ctx = self.app.app_context()

application/tests/admin_runtime_settings_test.py

@@ -4,14 +4,17 @@
 
 import os
 import unittest
+from unittest import mock
 
 from application import create_app, sqla
 from application.utils.admin_panel import runtime_settings
 
 
 class TestAdminRuntimeSettings(unittest.TestCase):
     def setUp(self) -> None:
-        os.environ["NO_LOAD_GRAPH_DB"] = "1"
+        patcher = mock.patch.dict(os.environ, {"NO_LOAD_GRAPH_DB": "1"})
+        patcher.start()
+        self.addCleanup(patcher.stop)
         self.app = create_app(mode="test")
         self.ctx = self.app.app_context()
         self.ctx.push()

application/tests/api_tokens_test.py

@@ -213,7 +213,11 @@ def test_admin_oie_allows_bearer(self) -> None:
             name="admin-read",
             expires_at=datetime.now(timezone.utc) + timedelta(days=7),
         )
-        with patch.dict(os.environ, {"CRE_ALLOW_IMPORT": "1"}):
+        # This test is about bearer auth, not Redis (CI has none): stub the queue status.
+        with patch.dict(os.environ, {"CRE_ALLOW_IMPORT": "1"}), patch(
+            "application.utils.rq_dashboard_snapshot.oie_rq_status",
+            return_value={"queues": []},
+        ):
             with self.app.test_client() as client:
                 resp = client.get(
                     "/admin/oie/rq/status",

application/tests/librarian/evaluate_harness_test.py

@@ -23,6 +23,7 @@
 import io
 import os
 import unittest
+from unittest import mock
 from typing import Iterator, List, Optional
 
 from application.utils.librarian.schemas import CreCandidate, RetrievalAudit
@@ -297,6 +298,13 @@ class BoundaryGateTest(unittest.TestCase):
         os.path.dirname(__file__), "fixtures", "golden_dataset.json"
     )
 
+    def setUp(self) -> None:
+        # The harness loads the shipped librarian config, which sets promoted defaults
+        # (e.g. CRE_EMBED_EXPECTED_DIM) process-wide; keep them out of later tests.
+        patcher = mock.patch.dict(os.environ)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
     def test_synthetic_row_satisfies_the_live_queue_schema(self) -> None:
         from application.utils.librarian.section_validator import (
             section_from_queue_row,