fix(api): keep the flash-sale discovery test isolation-safe

The inactive-window test asserted that no active session exists at all, which
the shared test database breaks once another test has created one. Assert that
this session is absent from discovery instead.

apps/api/tests/flash_sales.rs

@@ -150,7 +150,8 @@ async fn inactive_window_falls_back_to_normal_price() {
     let res = add_item(&app, &owner, &session, &sku, 500, 5, 3).await;
     assert_eq!(res.status(), 201, "past sessions may still be configured");
 
-    // Not discoverable as active.
+    // Not discoverable as active. Scoped to this session: the shared test
+    // database keeps sessions other tests created.
     let active: Vec<serde_json::Value> = client()
         .get(app.url("/api/flash-sales"))
         .send()
@@ -159,7 +160,10 @@ async fn inactive_window_falls_back_to_normal_price() {
         .json()
         .await
         .unwrap();
-    assert!(active.is_empty(), "an elapsed session is not public");
+    assert!(
+        active.iter().all(|s| s["id"] != session.as_str()),
+        "an elapsed session is not public"
+    );
 
     let (token, _) = register_customer(&app, "fs-past").await;
     add_to_cart(&app, &token, &sku, 1).await;