tests: retarget /clear_pr_pls auth tests after the musician/radio split

test_musician_auth.py still probed /clear_pr_pls on the musician, but that
endpoint moved to betoniarka during the split - the musician now 404s it, so
all three tests failed 404 != 401/200. This was pre-existing debt, unrelated to
the AI/share/bridge work; it just kept the integration job red.

Split the coverage to match the current architecture:
* test_musician_auth.py exercises the same auth contract (no key -> 401, key ->
  200, key unset -> open) against /get_share_list, an authenticated endpoint the
  musician still serves, with a valid body so the permitted case is a clean 200
  rather than a 400;
* new test_betoniarka_auth.py covers /clear_pr_pls where it now lives, pointing
  PRIORITY_PLAYLIST_PATH at a tmp file so the authorised case can truncate it,
  and checks /ping stays open;
* conftest.py adds conjurer_betoniarka to sys.path so the service imports.

Verified in a clean venv (pytest flask waitress requests), matching the CI
integration job: 13 passed, up from 3 failed / 6 passed. Unit suite unaffected
(23 passed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/integration/test_betoniarka_auth.py

@@ -0,0 +1,41 @@
+"""Integration: betoniarka enforces the shared key on /clear_pr_pls (which
+moved here from the musician during the radio split) while /ping stays open.
+
+This is the same auth contract the musician test used to cover for
+/clear_pr_pls, now exercised against the service that actually owns it.
+"""
+import betoniarka as b
+
+
+def _client(tmp_path, key="test-secret"):
+    b.API_KEY = key
+    # /clear_pr_pls truncates this file; point it at a writable temp path so the
+    # authorised case reaches 200 instead of failing on the default
+    # /srv/betoniarka/data path that does not exist in CI.
+    b.PRIORITY_PLAYLIST_PATH = tmp_path / "priority_queue.playlist"
+    return b.app.test_client()
+
+
+def test_clear_pr_pls_rejected_without_key(tmp_path):
+    client = _client(tmp_path)
+    assert client.get("/clear_pr_pls").status_code == 401
+
+
+def test_clear_pr_pls_accepted_with_key(tmp_path):
+    client = _client(tmp_path)
+    resp = client.get(
+        "/clear_pr_pls", headers={"X-Conjurer-Api-Key": "test-secret"}
+    )
+    assert resp.status_code == 200
+    # The endpoint's job is to empty the priority playlist.
+    assert b.PRIORITY_PLAYLIST_PATH.read_text() == ""
+
+
+def test_ping_is_open(tmp_path):
+    client = _client(tmp_path)
+    assert client.get("/ping").status_code == 200
+
+
+def test_open_when_key_unset(tmp_path):
+    client = _client(tmp_path, key=None)
+    assert client.get("/clear_pr_pls").status_code == 200