fix(tests): repair stale pins surfaced by the Phase 6 full-suite run

Two suite failures, neither caused by scanner code (the Phase 6 diff
touches no handler):

- search_test invalid_library_id expected the pre-family-lens 404;
  7e586df4 shipped the AGENTS-mandated 403 for every out-of-set id
  (existence must not be enumerable) and docs/contract_pins.md:195
  documented it — this one subtest's expectation was missed. Pin
  widened to the shipped 403.
- TestWebSocketPingPong deleted: it asserted a text-level ping→pong
  exchange no server code has ever implemented and no client has ever
  sent; it passed vacuously through its read-timeout path until
  interleaved scan_progress broadcasts from the live server's scans
  reached the socket first. Keepalive is the standard protocol-level
  ping the hub already sends. Never-built behavior is not a pinnable
  contract.

Both recorded in docs/contract_pins.md. Full container suite is green
except the documented pre-existing TestAdminCreateUser red.

docs/contract_pins.md

@@ -237,3 +237,23 @@ cover_image_path, has_conflict, format_group, badge`.
 - Watcher: a failed capability probe (one `Add` on a root folder)
   disables the watcher with ONE startup line instead of per-directory
   warning spam.
+
+## 2026-10-20 — Stale pin repair (behavior shipped in 7e586df4)
+
+- `GET /api/media-items/search` with an explicit `library_id` outside
+  the requesting user's visible set — INCLUDING a nonexistent id —
+  answers **403** (`library not accessible`), not 404. The family-lens
+  standing rule (AGENTS.md) mandates 403 for every out-of-set id so
+  library existence is not enumerable; Phase 1 (7e586df4) shipped it
+  and documented it here, but the `invalid library_id` subtest in
+  search_test.go still pinned the pre-family-lens 404. Pin widened to
+  the shipped 403; no server change (discovered during the Phase 6
+  full-suite run; the Phase 6 diff touches no handler code).
+- `TestWebSocketPingPong` DELETED: it asserted a text-level
+  `{"type":"ping"}` → `{"type":"pong"}` exchange that no server code
+  has ever implemented and no client (web/src, Android) has ever sent.
+  It passed vacuously through its read-timeout path (deadline error
+  skipped the asserts) until interleaved `scan_progress` broadcasts
+  from the live server's scans started reaching the socket first.
+  Keepalive is the standard protocol-level ping the hub already sends.
+  Never-built behavior is not a pinnable contract.