Test design

Inspecting what reaches cursor.execute catches the f-string login four green tests cleared

Two Python login functions return the same 200s and 401s, and only the one keeping user values in a parameter tuple survives a test that reads what a fake cursor received. The placeholder it checks is SQLite's.