Fix TLS listener tests failing the DCR store check

closeTrackingStorage embedded the storage.Storage interface, which
hides the DCR methods. The constructor asserts DCRCredentialStore
before it loads the TLS certificate, so the TLS listener tests failed
on the DCR check instead of the behavior they cover.

Embed *storage.MemoryStorage so the wrapper satisfies the interface.
Also assert the certificate load error in the cleanup test, which
only checked for any error and passed for the wrong reason.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: jhrozek

pkg/authserver/runner/embeddedauthserver_test.go

@@ -1996,8 +1996,8 @@ func TestNewEmbeddedAuthServerWithStorage_RequiredInputs(t *testing.T) {
 	t.Run("nil config returns error without panic or cleanup", func(t *testing.T) {
 		t.Parallel()
 
-		tracker := &closeTrackingStorage{Storage: storage.NewMemoryStorage()}
-		t.Cleanup(func() { require.NoError(t, tracker.Storage.Close()) })
+		tracker := &closeTrackingStorage{MemoryStorage: storage.NewMemoryStorage()}
+		t.Cleanup(func() { require.NoError(t, tracker.MemoryStorage.Close()) })
 
 		server, err := NewEmbeddedAuthServerWithStorage(context.Background(), nil, tracker)
 		require.Nil(t, server)
@@ -2712,21 +2712,22 @@ func TestNewEmbeddedAuthServer_DCRBoot(t *testing.T) {
 }
 
 // closeTrackingStorage wraps an authserver storage and counts Close calls.
-// It implements storage.Storage by embedding the wrapped value, then
-// overriding Close to record the call before delegating to the inner
-// Storage. Used by TestNewEmbeddedAuthServer_ClosesStorageOnError to
+// It embeds *storage.MemoryStorage (not the storage.Storage interface) so it
+// also satisfies storage.DCRCredentialStore, and overrides Close to record
+// the call before delegating to the inner storage. Used by
+// TestNewEmbeddedAuthServer_ClosesStorageOnError to
 // verify the deferred-cleanup contract on NewEmbeddedAuthServer's error
 // paths without depending on goroutine-count heuristics (which are
 // confounded by HTTP transport keep-alive goroutines this package does
 // not own).
 type closeTrackingStorage struct {
-	storage.Storage
+	*storage.MemoryStorage
 	closeCount atomic.Int32
 }
 
 func (s *closeTrackingStorage) Close() error {
 	s.closeCount.Add(1)
-	return s.Storage.Close()
+	return s.MemoryStorage.Close()
 }
 
 // TestNewEmbeddedAuthServer_ClosesStorageOnError pins the post-#5185
@@ -2752,7 +2753,7 @@ func (s *closeTrackingStorage) Close() error {
 func TestNewEmbeddedAuthServer_ClosesStorageOnError(t *testing.T) {
 	t.Parallel()
 
-	tracker := &closeTrackingStorage{Storage: storage.NewMemoryStorage()}
+	tracker := &closeTrackingStorage{MemoryStorage: storage.NewMemoryStorage()}
 
 	// Always-500 discovery endpoint forces the DCR resolver to fail
 	// during buildUpstreamConfigs — i.e. inside the leak window between
@@ -2804,7 +2805,7 @@ func TestNewEmbeddedAuthServer_ClosesStorageOnError(t *testing.T) {
 func TestNewEmbeddedAuthServer_TLSListenerClosesStorageOnError(t *testing.T) {
 	t.Parallel()
 
-	tracker := &closeTrackingStorage{Storage: storage.NewMemoryStorage()}
+	tracker := &closeTrackingStorage{MemoryStorage: storage.NewMemoryStorage()}
 
 	cfg := &authserver.RunConfig{
 		SchemaVersion: authserver.CurrentSchemaVersion,
@@ -2830,6 +2831,7 @@ func TestNewEmbeddedAuthServer_TLSListenerClosesStorageOnError(t *testing.T) {
 
 	embed, err := NewEmbeddedAuthServerWithStorage(context.Background(), cfg, tracker, WithListenerHost("localhost"))
 	require.Error(t, err)
+	assert.Contains(t, err.Error(), "load auth server TLS listener certificate")
 	assert.Nil(t, embed)
 	assert.Equal(t, int32(1), tracker.closeCount.Load(),
 		"a TLS listener certificate load failure must Close the storage exactly once via the deferred-cleanup gate")
@@ -2904,7 +2906,7 @@ func TestNewEmbeddedAuthServer_TLSListenerRequiresHost(t *testing.T) {
 			if tt.publicConstructor {
 				embed, err = NewEmbeddedAuthServer(context.Background(), cfg, opts...)
 			} else {
-				tracker = &closeTrackingStorage{Storage: storage.NewMemoryStorage()}
+				tracker = &closeTrackingStorage{MemoryStorage: storage.NewMemoryStorage()}
 				embed, err = NewEmbeddedAuthServerWithStorage(context.Background(), cfg, tracker, opts...)
 			}
 			assert.Equal(t, 1, optionCalls, "constructor options must be applied once")