fix: harden request handling, pipeline containment, and startup boundaries

backend/tests/test_auth_routes.py

@@ -113,6 +113,29 @@ def test_seed_session_authenticates_requests_without_a_cookie() -> None:
     assert response.json() == {"display_name": "Seed Listener"}
 
 
+def test_seed_session_failure_keeps_application_serving() -> None:
+    async def spotify_handler(request: httpx2.Request) -> httpx2.Response:
+        return httpx2.Response(400)
+
+    app = create_app(
+        application_settings=Settings(
+            app_mode=AppMode.LIVE,
+            spotify_client_id="client-id",
+            anthropic_api_key="test-key",
+            spotify_seed_refresh_token="seed-refresh",
+        ),
+        http_transport=httpx2.MockTransport(spotify_handler),
+    )
+    with TestClient(app, follow_redirects=False) as client:
+        health_response = client.get("/api/health")
+        login_response = client.get("/api/auth/login")
+
+        assert app.state.seed_session_id is None
+
+    assert health_response.status_code == 200
+    assert login_response.status_code == 307
+
+
 def _live_settings() -> Settings:
     return Settings(
         app_mode=AppMode.LIVE,