fix(tests): repair stale pins surfaced by the Phase 6 full-suite run

Two suite failures, neither caused by scanner code (the Phase 6 diff
touches no handler):

- search_test invalid_library_id expected the pre-family-lens 404;
  7e586df4 shipped the AGENTS-mandated 403 for every out-of-set id
  (existence must not be enumerable) and docs/contract_pins.md:195
  documented it — this one subtest's expectation was missed. Pin
  widened to the shipped 403.
- TestWebSocketPingPong deleted: it asserted a text-level ping→pong
  exchange no server code has ever implemented and no client has ever
  sent; it passed vacuously through its read-timeout path until
  interleaved scan_progress broadcasts from the live server's scans
  reached the socket first. Keepalive is the standard protocol-level
  ping the hub already sends. Never-built behavior is not a pinnable
  contract.

Both recorded in docs/contract_pins.md. Full container suite is green
except the documented pre-existing TestAdminCreateUser red.

cmd/server/tests/search_test.go

@@ -413,10 +413,15 @@ func TestCollectionSearchLibraryFilter(t *testing.T) {
 			shouldContain: book2ID,
 		},
 		{
-			name:           "invalid library_id",
-			query:          "Harry",
-			libraryID:      "00000000-0000-0000-0000-000000000000",
-			expectedStatus: http.StatusNotFound,
+			name:      "invalid library_id",
+			query:     "Harry",
+			libraryID: "00000000-0000-0000-0000-000000000000",
+			// Family-lens standing rule (AGENTS.md): an explicit
+			// library_id outside the visible set is a 403, never a
+			// silent pass — and a nonexistent id is out-of-set too,
+			// so existence is not enumerable. Behavior shipped in
+			// 7e586df4 (Phase 1); this pin update was missed then.
+			expectedStatus: http.StatusForbidden,
 		},
 	}