test: reconcile file_storage/branding tests with #401 and #404 on main

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Author: antosubash

modules/branding/tests/test_branding_reap_ordering.py

@@ -80,7 +80,9 @@ async def delete(key):
         monkeypatch.setattr(backend, "delete", delete)
         await reaper.reap(app, file_id, tenant_id=a.tenant_id)
 
-    assert events == ["commit", "delete"]
+    # The original and any cached thumbnail variants: every delete after the commit.
+    assert events[0] == "commit" and "delete" in events
+    assert set(events[1:]) == {"delete"}
     assert (await _row(app, file_id)).is_deleted is True
 
 

modules/file_storage/tests/test_file_storage_public_cookieless.py

@@ -81,6 +81,7 @@ async def test_file_storage_signed_in_session_survives_public_fetch(authenticate
 
 async def test_file_storage_other_routes_keep_session_behaviour(client):
     """Only the public file reads are cookieless; an anonymous page still writes it."""
-    resp = await client.get("/users/login")
+    # A real page load (Accept: text/html) — anonymous non-page calls stay cookieless (#349).
+    resp = await client.get("/users/login", headers={"Accept": "text/html"})
     assert resp.status_code == 200
     assert resp.headers.get("set-cookie", "").startswith("session=")