test: cover curl commands, sensitive variables and logout - #235

• go vet on the merged integration-tests package succeeds, so the new base file mount_download_test.go defines no test helper whose name clashes with a helper this PR adds (for example requestRecorder, jsonField or tokenState).
• None of the PR's tests use the help-page examples, Filesystem::makePathRelative or mockssh.ExecHandler, which are the only things the base commits changed.
• TestApiCurl_RejectsHost no longer uses an otherServer recorder. Its doc comment now calls the host check a second safeguard, because the path is appended to the API URL.

This round covers only the base movement, and I found nothing in it that breaks this PR. The PR changes only integration tests, which run in the repository's Go test job. I ran go vet on the merged integration-tests package to confirm it still compiles alongside the new base test file.

• Commit: 6fc095b
• Base moved since: bade27f
• Model: claude-opus-5-5