test: stop aiming I12 transport tests at recycled ports

[plusky]

What

Stop the I12 transport-error tests from connecting to an ephemeral 127.0.0.1 port that has been freed back to the OS.

wiremock 0.6 binds 127.0.0.1:0 and keeps those listeners in a process-wide pool for the process lifetime. The five I12 sites bound an ephemeral port, dropped the listener, and fired a request at the freed address expecting ECONNREFUSED. Under load that port can belong to a newly created pooled listener (~1–4 failures per 300 stress runs; independently reproduced in #93):

• unwrap_err() panics on Ok carrying another test's corpus
• .expect(1) over-counts a foreign request
• worst, api_key_absent_from_transport_error_i12 goes green without sanitizing a transport error at all

All five sites now connect to 127.0.0.2:1 — still loopback (127.0.0.0/8), so the kernel refuses immediately (or returns ENETUNREACH if the extra address is not configured). A pooled listener binds only 127.0.0.1 and can never occupy that address.

• crates/bugwarden-core/tests/guard_wiremock.rs — get_bugs / whoami / valid_login I12 tests
• crates/bugwarden/tests/preflight_wiremock.rs — preflight whoami I12
• crates/bugwarden/tests/tools_wiremock.rs — MCP-visible whoami I12
• Shared helper in crates/bugwarden/tests/common/mod.rs for the two server binaries

A bounded TCP probe refuses to return an address that accepted or timed out. The client call itself is capped at 2s so a proxy/routing hang cannot become the 30s client timeout. The assertion requires reqwest's error sending request (Display and Debug) so an empty or HTTP-status error cannot pass a bare !contains(KEY). A mutation that retargets the helper at 127.0.0.1 fails the helper.

Why

#93 / #112 only stopped asserting on [0] of a polluted recording. The bind-then-drop(listener) hazard remained at every I12 site, including a silent coverage loss on a security invariant.

Invariants

I12 is unchanged: the Bugzilla API key must not appear in a real transport-level error. Fail-closed behavior is untouched. No production code changed except adding the time feature to bugwarden-core's tokio dev-dependency so the tests can bound the connect.

Adversarial review (pre-PR)

• No remaining bind-drop-connect on 127.0.0.1:0 in guard_wiremock, preflight_wiremock, or tools_wiremock.
• Probe URL is built from the probed socket (they cannot drift). assert_ne!(ip, 127.0.0.1) kills a bind-then-drop mutation.
• I12 is asserted on a real reqwest transport error (error sending request), not a timeout-with-empty-text.
• Hang bound: 500ms TCP probe + 2s client timeout. Not a public TEST-NET address.

Accepted findings (fixed before this PR): URL/probe drift; a 127.0.0.1 mutation that would still pass; missing hang budget; duplicated helper across the two server test binaries.

Rejected: capturing the warn-log in tools_wiremock to assert the internalized whoami error text. That test's contract is the client-visible surface (I2 uniform denial). The transport error is already asserted in the three core tests and the preflight test.

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy -p bugwarden --features gen --all-targets -- -D warnings
• cargo test --workspace --all-targets --locked
• cargo deny check

Closes #115