test(jobs): drive expiry/reaper coverage to 95%

Cover the anon-TTL reaper, 6/2/1h imminent + reminder cadence, stack
expiry (incl. the in-cluster k8s namespace teardown path), pending-
deletion expirer, and magic-link reconciler. Adds in-package tests for
unexported seams: deprovisionMinIOUser, deleteStorageObjects, the
in-cluster ExpireStacks Work branch, signMagicLinkResendJWT, and
rows.Err propagation. expire_stacks.go's hardcoded SA-token/CA paths +
k8s API base become test-overridable package vars (identical prod
defaults, no behavior change). Aggregate target-file coverage 87% → 95%.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805