Fix test env isolation: a popped variable comes back from .env

Caught the moment a real LDAP_REQUIRED_GROUP landed in .env: ldap_auth_check's
"a just-provisioned account appears in the Admin console list" started failing,
consistently, with no code change that could explain it.

start() removed LDAP_REQUIRED_GROUP from the subprocess environment so the test
could run without a group gate. But the server imports server/db.py, which
calls load_dotenv(), and python-dotenv skips only keys ALREADY PRESENT in
os.environ - so a popped variable is helpfully restored from the developer's
.env inside the child process. The test was quietly running against the real
required group, the fake "outsider" account was refused by it, and the account
under test was never provisioned.

Setting the variable to an empty string fixes it: empty still counts as
present, so load_dotenv leaves it alone.

Fixed in both harnesses - ldap_auth_check and browser_check, the latter shared
by 39 files - and corrected the fix suggested in BL-028, which said to pop
MICRON_DB_URL and would therefore not have worked either.

Worth stating as a rule: in this repo a test cannot assume an environment
variable is ABSENT. .env re-supplies it in any subprocess. Force the value you
want; never remove it.

ldap_auth_check 32/32, browser_check re-run green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/waves/backlog.md

@@ -601,8 +601,12 @@ deliberately deferred.
   anyone who has ever used the asset picker — the API is genuinely configured, returns
   real Micron tags, and three checks fail. Nothing is wrong with the app; the test's
   premise is violated by the environment it runs in.
-- **Fix:** pop `MICRON_DB_URL` from the env for that server, exactly as `start_server`
-  now pops `LDAP_REQUIRED_GROUP` for the same reason (`T10.7`).
+- **Fix:** SET `MICRON_DB_URL` empty for that server — do not pop it. `server/db.py`
+  calls `load_dotenv()` at import, and python-dotenv only skips keys already present in
+  `os.environ`, so a *popped* variable is restored from the developer's `.env` inside the
+  subprocess and the test runs against the real catalog anyway. An empty string counts as
+  present and therefore wins. `start_server` does exactly this for `LDAP_REQUIRED_GROUP`
+  (`T10.7`), after the pop-based version was caught doing the wrong thing.
 - **Why not now:** it is not this wave's defect and the fix belongs with whoever owns
   the asset picker's tests. Recorded so the failure is not mistaken for D13 fallout.
 - **Suggested wave or follow-up:** next housekeeping pass.