tests: add unit tests for the openframe fork surfaces with no coverage

[oleg-flamingocx]

Guard the fork-only code against regressions during upstream syncs:

• server/service/openframe: the whole agent token-auth pipeline had zero tests — AES-GCM decrypt (all key sizes, short/tampered/wrong-key payloads, error-count reset), token file extraction, the RW-mutex authorization manager (race-checked), and the refresh skip logic (empty/unchanged token, extract failures).
• redis key-prefix: prefixedConn Do/Send/DoWithTimeout/Bind/ReadOnly forwarding, the PUBSUB introspection rule, WATCH/store-variant/LMOVE/ ZRANGESTORE/blocking-pop/FCALL table cases, input-slice immutability, and toInt/toString/prefixOne edge cases.
• host-assignments service layer: the 8 add/remove/replace/list svc methods previously had only a manual curl script — now pin the openframe-mode gate, authz ordering (observer write rejection), host existence validation with de-duplication, and datastore delegation, plus direct tests for verifyHostsToAssociate.
• mysql: openframeForeignTeam pin/foreign/unpinned decision (pure ctx logic, runs without MYSQL_TEST).