docs(oidc): drop the upgrade-path claim from the release-path rationale

The two-flagged-row state was never released, so no installation can carry it
in -- the reason to release every flagged row is not repair, it is that the
sweep's invariant is not enforced anywhere and scalar_one_or_none() turns a
broken one into a failed boot. Comment, test docstring and test name say that
instead.

backend/app/core/oidc_env.py

@@ -103,10 +103,10 @@ async def apply_env_oidc_provider(db: AsyncSession) -> None:
 
     if config is None:
         # Nothing to look up by name any more, so the previously managed rows are
-        # found by the flag -- and then released. All of them: an install
-        # upgraded from a version that did not sweep the flag on rename carries
-        # two, and scalar_one_or_none() would raise MultipleResultsFound out of
-        # the lifespan instead of booting.
+        # found by the flag -- and then released. All of them: the upsert's sweep
+        # should keep that at one, but scalar_one_or_none() would raise
+        # MultipleResultsFound out of the lifespan the moment it isn't, and
+        # losing the boot is too steep a price for an invariant check.
         released_rows = (
             (await db.execute(select(OIDCProvider).where(OIDCProvider.is_env_managed.is_(True)))).scalars().all()
         )

backend/tests/integration/test_oidc_env_apply.py

@@ -342,10 +342,10 @@ async def test_boot_survives_removing_the_config_after_a_rename(db_session, monk
 
 
 @pytest.mark.asyncio
-async def test_a_database_left_with_two_managed_rows_is_repaired(db_session, monkeypatch):
-    """An install upgraded from the version that never swept the flag already
-    has two managed rows. Releasing only one of them would leave the same dead
-    end behind, so the release path releases every row it finds."""
+async def test_every_managed_row_is_released_not_just_one(db_session, monkeypatch):
+    """The upsert's sweep should keep this at one row. Should is not enforced by
+    the schema, and the cost of being wrong is the whole release path raising
+    MultipleResultsFound out of the lifespan -- so it releases what it finds."""
     for name in ("Keycloak", "Authentik"):
         stale = OIDCProvider(
             name=name,