Fix flaky sign_out teardown in six test suites (#3208)

Six suites (passkey, MFA, SnapTrade, categorize, onboarding and the Active
Storage authorization integration tests) share a sign_out helper that deletes
the user's sessions through the controller, one HTTP request per session,
iterating in unspecified order. The moment the loop deletes the session the
test itself is signed in with, every later request in the loop is
unauthenticated and silently deletes nothing, so whichever sessions happen to
sort after it survive. The sessions fixture belongs to the same user these
suites use, so a surviving fixture row then fails every assertion that expects
the user to have no sessions.

Row order usually favors the fixture, which is why the suites usually pass.
Under parallel CI they fail a few times a week, always in this file family,
always with the fixture session as the leftover. Forcing newest-first order
reproduces it deterministically on current main: ten of the fifteen passkey
tests fail.

Teardown hygiene is not the behavior under test, so the helpers now destroy
the sessions directly, which no order can break. All six suites run green
three times in a row.

test/integration/active_storage_authorization_test.rb

@@ -288,7 +288,9 @@ class ActiveStorageAuthorizationTest < ActionDispatch::IntegrationTest
   private
 
     def sign_out(user)
-      user.sessions.each { |session| delete session_path(session) }
+      # Deleting through the controller de-authenticates mid-loop and later
+      # deletes silently no-op; destroy directly, no order to break.
+      user.sessions.destroy_all
     end
 
     def with_protected_record_types(*types)