cocalc-api/test: fix edge cases in api and improve testing

This commit updates the conftest.py test fixtures to properly support both
account-scoped and project-scoped API keys during testing.

The validate_api_key_config fixture now:
- First attempts to detect scope via hub.system.test() (account-scoped keys)
- Falls back to project.system.test() if hub fails (project-scoped keys)
- Reports both errors if both endpoints fail, for better debugging

Also clarifies that the hub endpoint's system.test() is for account-scoped
keys only, with clear comments directing project-scoped key users to the
project endpoint.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: haraldschilly

src/packages/server/conat/api/system.ts

@@ -18,11 +18,11 @@ export function ping() {
   return { now: Date.now() };
 }
 
-export async function test({
-  account_id,
-}: { account_id?: string } = {}) {
+export async function test({ account_id }: { account_id?: string } = {}) {
   // Return API key scope information and server time
   // The authFirst decorator determines the scope from the API key and injects account_id.
+  // Note: This endpoint only accepts account-scoped keys (see packages/next/pages/api/conat/hub.ts).
+  // For project-scoped keys, use the project endpoint (packages/next/pages/api/conat/project.ts).
   const response: { account_id: string; server_time: number } = {
     account_id: account_id ?? "",
     server_time: Date.now(),

src/python/cocalc-api/tests/conftest.py

@@ -126,10 +126,30 @@ def validate_api_key_config(hub):
     For account-scoped keys, requires COCALC_PROJECT_ID to be set.
     For project-scoped keys, no additional configuration needed.
     """
+    scope = None
+    hub_error = None
+
+    # First, try the hub endpoint (works only for account-scoped keys)
     try:
         scope = hub.system.test()
     except Exception as e:
-        pytest.fail(f"Failed to determine API key scope: {e}")
+        hub_error = e
+
+    # If hub check failed, fall back to the project endpoint so project-scoped keys work
+    if scope is None:
+        try:
+            project_client = Project(
+                api_key=hub.api_key,
+                host=hub.host,
+                project_id=os.environ.get("COCALC_PROJECT_ID"),
+            )
+            scope = project_client.system.test()
+        except Exception as project_error:
+            pytest.fail(
+                "Failed to determine API key scope using both hub and project endpoints:\n"
+                f"  hub error: {hub_error}\n"
+                f"  project error: {project_error}"
+            )
 
     is_account_scoped = "account_id" in scope
     is_project_scoped = "project_id" in scope