Improve test reliability by adding cookie assertions and refining user cleanup

Add assertion for `connect.sid` cookie in login helper and refine user deletion in `executive-meetings-visibility.test.mjs` to only remove users from the current test run.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 25d8531b-a2fe-4c98-b988-638cc149da80
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/RZuzKd2
Replit-Helium-Checkpoint-Created: true

artifacts/api-server/tests/executive-meetings-visibility.test.mjs

@@ -32,10 +32,13 @@ async function login(username, password) {
   });
   assert.equal(res.status, 200, `login expected 200, got ${res.status}`);
   const setCookie = res.headers.get("set-cookie");
-  return setCookie
+  assert.ok(setCookie, "login response missing set-cookie header");
+  const cookie = setCookie
     .split(",")
     .map((c) => c.split(";")[0].trim())
     .find((c) => c.startsWith("connect.sid="));
+  assert.ok(cookie, "no connect.sid cookie returned by login");
+  return cookie;
 }
 
 async function listApps(cookie) {
@@ -47,11 +50,12 @@ async function listApps(cookie) {
 }
 
 before(async () => {
-  // Defensive sweep: kill any leftover users from a previous aborted run
-  // whose username matches our prefix family. user_roles / user_groups
-  // cascade via FKs.
+  // Defensive sweep: only remove leftovers from this exact run's stamp,
+  // which is fresh per process. Avoids touching unrelated fixtures that
+  // happen to share the `emvis_` family in a shared test DB.
   await pool.query(
-    `DELETE FROM users WHERE username LIKE 'emvis\\_%' ESCAPE '\\'`,
+    `DELETE FROM users WHERE username LIKE $1`,
+    [`${USERNAME_PREFIX}%`],
   );
 
   receiverUsername = `${USERNAME_PREFIX}receiver`;