test(server): day order tests follow the dateless-day rule and the OIDC hop check reads the formatted call

DAY-SVC-048 and DAY-DEL-011 pinned the old reorder, which handed a day
without a date the first slot's date; they now expect it to keep none and
the day it passes to keep its own. OIDC-SSRF-003 reads oidc.service.ts as
text and missed the token call once Prettier put a trailing comma after its
hop budget of 0; the pattern takes the comma.

server/tests/unit/nest/day-removal.service.test.ts

@@ -409,8 +409,11 @@ describe('DayRemovalService.remove', () => {
 
     const appended = await days.create(trip.id);
     await days.reorder(trip.id, [d1.id, d2.id, appended.id, d3.id]);
-    // The pushed-out day lost its date to the new one and sits at the end without one.
-    expect((await dayRows(trip.id)).at(-1)).toEqual({ id: d3.id, day_number: 4, date: null });
+    // The new day has no date and takes none in its slot; the day it pushed back keeps its own.
+    expect((await dayRows(trip.id)).slice(-2)).toEqual([
+      { id: appended.id, day_number: 3, date: null },
+      { id: d3.id, day_number: 4, date: '2026-01-03' },
+    ]);
     await removal.remove(trip.id, d3.id, { userId: user.id });
 
     expect(await dayRows(trip.id)).toEqual([

server/tests/unit/nest/days.service.test.ts

@@ -942,7 +942,7 @@ describe('reorder', () => {
     expect(await reservationRow(res)).toMatchObject({ reservation_time: '2026-02-02T19:00' });
   });
 
-  it('DAY-SVC-048 — pins the known dates to the leading slots and nulls the slots beyond them', async () => {
+  it('DAY-SVC-048 — a day without a date keeps none when it moves before a dated one', async () => {
     const { user } = createUser(testDb);
     const trip = createTrip(testDb, user.id);
     const dated = createDay(testDb, trip.id, { date: '2026-03-01' });
@@ -950,11 +950,11 @@ describe('reorder', () => {
 
     await svc.reorder(trip.id, [dateless.id, dated.id]);
 
-    // The slot beyond the known dates must resolve to null: better-sqlite3
-    // refuses to bind the `undefined` a bare index lookup would hand it.
+    // The dateless day must resolve to null, not undefined: better-sqlite3
+    // refuses to bind the `undefined` a bare lookup would hand it.
     expect(await orderedDays(trip.id)).toEqual([
-      { id: dateless.id, day_number: 1, date: '2026-03-01' },
-      { id: dated.id, day_number: 2, date: null },
+      { id: dateless.id, day_number: 1, date: null },
+      { id: dated.id, day_number: 2, date: '2026-03-01' },
     ]);
   });
 

server/tests/unit/nest/oidc-ssrf.test.ts

@@ -42,7 +42,7 @@ describe('OIDC outbound calls', () => {
   it('OIDC-SSRF-003: the token exchange follows no redirect at all', () => {
     // A redirect there would hand client_secret to a second host, and the
     // platform default is to follow. The third argument is the hop budget.
-    const tokenCall = /safeFetchAdminConfigured\(\s*doc\.token_endpoint[\s\S]*?\}\s*,\s*0\s*\)/.test(SOURCE);
+    const tokenCall = /safeFetchAdminConfigured\(\s*doc\.token_endpoint[\s\S]*?\}\s*,\s*0\s*,?\s*\)/.test(SOURCE);
 
     expect(tokenCall).toBe(true);
   });