CS-11264 fix CI: fast-path reconciler.mounted + insert registry row in test

The 2c65f87 follow-up moved _realm-auth's registry-presence check to
`knownByUrl + DB probe` (mirroring multiRealmAuthorization). That's
correct for production but missed two test-mode realities that
multiRealmAuthorization handles by checking `realms[]` first:

1. `registerExistingMounts` (used by runTestRealmServer and the
   legacy pre-Phase-3 boot path) puts realms into
   `reconciler.mounted` but DELIBERATELY does NOT put them in
   `knownByUrl` — so the reconcile-time unmount phase doesn't tear
   legacy mounts down when they're absent from realm_registry.
   Test 258 ("creates session rooms when missing") trips this:
   testRealm is in `mounted` but not `knownByUrl` and not in the
   DB, so the handler skipped it and returned an empty sessions
   map.

2. The new regression test (259) asserts `knownByUrl.has(...)` as a
   precondition, but the test fixture's testRealm never gets a
   realm_registry row inserted, so that precondition was always
   false — the test was checking a state that never existed in
   test mode.

Fixes:

- `handle-realm-auth.ts`: add `reconciler.mounted` as the first
  fast-path in the lookup order, mirroring multiRealmAuthorization
  exactly. A realm currently mounted on this process is
  authoritatively present — the registry probe is the slow fallback
  for cases where it isn't.
- `realm-auth-test.ts`: in test 259, insert a `realm_registry` row
  via `insertSourceRealmInRegistry` and call
  `testingOnlyReconcile()` before eviction. The test now exercises
  the "registry row exists, realm absent from realms[] and
  reconciler.mounted" path it claims to.

Author: lukemelia

packages/realm-server/handlers/handle-realm-auth.ts

@@ -56,15 +56,27 @@ export default function handleRealmAuth({
     // the mount happens later, when the holder actually hits a realm
     // endpoint and findOrMountRealm/lookupOrMount runs there.
     //
-    // Same lookup order as multiRealmAuthorization (CS-11238): in-memory
-    // reconciler.knownByUrl first, then a single batched probe against
-    // realm_registry for any URLs not yet reflected in this process
-    // (e.g. a freshly-published row from a peer instance between NOTIFY
-    // and the next reconcile pass).
+    // Mirrors multiRealmAuthorization's three-step lookup order
+    // (CS-11238):
+    //   1. reconciler.mounted — covers realms currently mounted on
+    //      this process, including the mid-start window AND legacy-
+    //      registered mounts from registerExistingMounts that have
+    //      no realm_registry row (test fixtures and the pre-Phase-3
+    //      boot path use this — the reconciler intentionally does
+    //      not put them in knownByUrl so the unmount phase doesn't
+    //      tear them down).
+    //   2. reconciler.knownByUrl — in-memory mirror of realm_registry,
+    //      refreshed at boot, on NOTIFY, and by the safety-net poll.
+    //   3. Direct realm_registry probe — covers the gap between a
+    //      peer instance's INSERT+NOTIFY and this instance's next
+    //      reconcile pass.
     let registeredUrls = new Set<string>();
     let urlsToProbe: string[] = [];
     for (let realmUrl of accessibleRealmUrls) {
-      if (reconciler.knownByUrl.has(realmUrl)) {
+      if (
+        reconciler.mounted.has(realmUrl) ||
+        reconciler.knownByUrl.has(realmUrl)
+      ) {
         registeredUrls.add(realmUrl);
       } else {
         urlsToProbe.push(realmUrl);

packages/realm-server/tests/realm-auth-test.ts

@@ -13,6 +13,7 @@ import {
   testRealmHref,
 } from './helpers';
 import { createJWT as createRealmServerJWT } from '../utils/jwt';
+import { insertSourceRealmInRegistry } from '../lib/realm-registry-writes';
 import type { RealmServer } from '../server';
 
 module(basename(__filename), function () {
@@ -120,6 +121,21 @@ module(basename(__filename), function () {
       });
       sinon.stub(MatrixClient.prototype, 'joinRoom').resolves();
 
+      // Bring the test fixture's realm into the realm_registry so the
+      // post-restart state we're simulating is faithful: in production
+      // every realm has a registry row, but runTestRealmServer
+      // legacy-registers its testRealm into reconciler.mounted without
+      // inserting (registerExistingMounts deliberately bypasses
+      // knownByUrl to preserve legacy mounts across reconcile passes).
+      // Insert + reconcile so reconciler.knownByUrl reflects the row,
+      // matching what a real boot would have done.
+      await insertSourceRealmInRegistry(dbAdapter, {
+        url: testRealmHref,
+        diskId: 'node-test_realm/test',
+        ownerUsername: 'node-test_realm',
+      });
+      await testRealmServer.testingOnlyReconcile();
+
       // Simulate the post-restart state: registry row + knownByUrl
       // entry are present (reconciler boot has reflected the registry),
       // but neither realms[] nor reconciler.mounted holds an active