Cover the refresh branch and four more refusals

[blaipr]

What

7 tests closing the last gaps in four controllers.

The refresh branch

Refreshing an authorisation is a different persistence path from editing one: the token is regenerated and the vault re-encrypted, through two updates keyed on the user rather than the single one a plain edit makes. The response text is identical either way, so the test tells the branch apart by which queries actually ran — which is the only thing that distinguishes them from outside.

Four refusals

• Creating a custom field or an item preset without permission.
• Viewing a field definition that has been deleted — reported as not found, matching what its sibling edit route already answers.
• A database failure while saving a field, and while loading the users/groups/profiles pickers a preset form needs — each reported rather than escaping as an unhandled error.

Testing

Integration: 50 tests green across the three classes, no deprecations or notices. All four controllers are now fully covered, and no gap in them turned out to be an accessor or an unreachable branch.