fix(tests): switch HMAC rejection tests from GET to POST endpoint

The four rejection tests in tests/integration/test_hmac.py
(test_hmac_no_key_rejected, test_hmac_wrong_key_rejected, and their
async variants) were calling client.get_enums(), which is a GET
request. The Comlink HMAC service does not protect GET endpoints,
so the server returned 200 OK regardless of authentication and the
expected SwgohComlinkException was never raised, causing all four
tests to fail with "DID NOT RAISE".

Switch to client.get_player_arena(allycode=TEST_ALLYCODE,
player_details_only=True), which is a POST request to /playerArena
(an HMAC-protected endpoint). Use the shared TEST_ALLYCODE constant
from conftest so the rejection tests align with the existing
get_player and get_player_arena success tests.

Verified end-to-end against a live HMAC-protected Comlink container:
all four tests now correctly observe HTTP 403 HMACValidationError
responses and pass; a positive control with valid keys returns a
real playerDetailsOnly response.

Fixes #88

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MarTrepodi

tests/integration/test_hmac.py

@@ -14,6 +14,7 @@
     COMLINK_HMAC_URL,
     HMAC_ACCESS_KEY,
     HMAC_SECRET_KEY,
+    TEST_ALLYCODE,
 )
 
 pytestmark = pytest.mark.integration
@@ -48,14 +49,24 @@ def test_hmac_sync_player_request_succeeds(comlink_hmac):
 
 @hmac_configured
 def test_hmac_no_key_rejected():
-    """Sync client without HMAC keys is rejected by the protected endpoint."""
+    """Sync client without HMAC keys is rejected by the protected endpoint.
+
+    Uses a POST endpoint (`playerArena`) because the Comlink HMAC service
+    only enforces HMAC on POST; GET endpoints like `/enums` are
+    unauthenticated.
+    """
     with SwgohComlink(url=COMLINK_HMAC_URL) as client, pytest.raises(SwgohComlinkException):
-        client.get_enums()
+        client.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
 
 
 @hmac_configured
 def test_hmac_wrong_key_rejected():
-    """Sync client with wrong secret key is rejected by the protected endpoint."""
+    """Sync client with wrong secret key is rejected by the protected endpoint.
+
+    Uses a POST endpoint (`playerArena`) because the Comlink HMAC service
+    only enforces HMAC on POST; GET endpoints like `/enums` are
+    unauthenticated.
+    """
     with (
         SwgohComlink(
             url=COMLINK_HMAC_URL,
@@ -64,7 +75,7 @@ def test_hmac_wrong_key_rejected():
         ) as client,
         pytest.raises(SwgohComlinkException),
     ):
-        client.get_enums()
+        client.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
 
 
 # ── Async: valid HMAC ───────────────────────────────────────────────────
@@ -94,23 +105,33 @@ async def test_hmac_async_player_request_succeeds(async_comlink_hmac):
 @hmac_configured
 @pytest.mark.asyncio
 async def test_hmac_no_key_async_rejected():
-    """Async client without HMAC keys is rejected by the protected endpoint."""
+    """Async client without HMAC keys is rejected by the protected endpoint.
+
+    Uses a POST endpoint (`playerArena`) because the Comlink HMAC service
+    only enforces HMAC on POST; GET endpoints like `/enums` are
+    unauthenticated.
+    """
     async with SwgohComlinkAsync(url=COMLINK_HMAC_URL) as client:
         with pytest.raises(SwgohComlinkException):
-            await client.get_enums()
+            await client.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
 
 
 @hmac_configured
 @pytest.mark.asyncio
 async def test_hmac_wrong_key_async_rejected():
-    """Async client with wrong secret key is rejected by the protected endpoint."""
+    """Async client with wrong secret key is rejected by the protected endpoint.
+
+    Uses a POST endpoint (`playerArena`) because the Comlink HMAC service
+    only enforces HMAC on POST; GET endpoints like `/enums` are
+    unauthenticated.
+    """
     async with SwgohComlinkAsync(
         url=COMLINK_HMAC_URL,
         access_key=HMAC_ACCESS_KEY,
         secret_key="wrong_secret_key",
     ) as client:
         with pytest.raises(SwgohComlinkException):
-            await client.get_enums()
+            await client.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
 
 
 # ── HMAC header verification ────────────────────────────────────────────