Add the missing auth tests: logout, bad credentials, signup's duplicate and email rules

## Summary

Most of the original scope landed while #26–#30 were being fixed: the suite went from 60-odd tests to 206. What is left is a handful of auth cases, which is a much smaller job than this issue used to describe.

## Already covered

| Original bullet | Where it landed |
|---|---|
| List payload (`avgRating`, `previewImage`, `oneReview`) | `tests/test_restaurant_list.py` (#62), extended for `numReviews` and the teaser in #66 |
| Search: name/city/description, the under-3-character branch, empty keyword 400 | `tests/test_restaurant_search.py` (#62, #65, #66) |
| Restaurant create validation and the 400 shape | `tests/test_error_shape.py`, `tests/test_form_lengths.py`, `tests/test_zipcode.py` |
| Edit/delete by a non-owner is 403, 404 for an unknown id | `tests/test_restaurants.py`, `tests/test_restaurant_detail.py` |
| Reviews: owner can't review their own restaurant, one per user, rating out of range, author-only edit/delete | `tests/test_reviews.py`, `tests/test_review_responses.py` |
| Restaurant images: add-image validation and preview handling | `tests/test_cover_photo.py`, `tests/test_images.py` |
| `/api/auth/` when unauthenticated | `tests/test_error_shape.py` (#65, where it also became a 401 instead of a 200) |
| Signup validation (oversized fields, missing CSRF, message shape) | `tests/test_form_lengths.py`, `tests/test_route_hygiene.py`, `tests/test_error_shape.py` |

## What is actually left

All four are in `auth_routes.py`, so `tests/test_auth.py` is the natural home. `tests/conftest.py` already has the fixtures.

1. **Logout.** `GET /api/auth/logout` is *used* by three test files to switch users, but nothing asserts it: after it, `/api/auth/` should be 401 and a login-only route should refuse.
2. **Bad credentials.** Nothing posts a wrong password or an unknown email to `/api/auth/login`. The 401 is currently only exercised through the missing-CSRF path, so the branch that checks `check_password` is untested.
3. **Signup's three custom validators.** `username_exists`, `user_exists` and `Email()` (`app/forms/signup_form.py`) have no test: a duplicate username, a duplicate email and a malformed address should each be a 400 naming the field.
4. **Create restaurant requires login.** All twelve `POST /api/restaurants/` tests log in first; nothing checks the signed-out case the way `test_edit_and_delete_require_login` does.

Worth doing alongside #35, so the new workflow has something to run.

Start with auth_routes.py and tests/test_auth.py, using the fixtures already defined in tests/conftest.py. Add coverage for logout, invalid login credentials, the three signup validators in app/forms/signup_form.py, and unauthenticated restaurant creation. Run the focused auth and restaurant tests; done means each case asserts the expected 401 or 400 response and field details.

Written by the indexing model from the issue text.