fix: enforce login token user/group allowlist consistently

[Toomad23]

Summary

Fixes #8165.

Align the createLoginToken handler with the allow-list semantics already used by ComposeWebFeatures: allow an explicitly listed user or a user with at least one listed link; reject everyone else.

The old predicate looks for any unlisted link, incorrectly rejecting a permitted group member who also has another link. Missing, null or empty user.links can also bypass the group allow-list check. Negate the entire positive membership expression rather than changing only the comparison inside .some().

This affects an already authenticated session with an array-valued passwordRequirements.loginTokens policy, not anonymous login. Existing restrictions on token-authenticated sessions, boolean policies, command names and expiry values remain unchanged.

Verification (local harness, not part of the diff)

Per maintainer feedback, the regression harness is kept locally and is not included in this PR. It uses Node's built-in test runner with no extra dependencies. The harness extracts and executes the actual validation block from meshuser.js with the real common validators. It does not create tokens, connect to a server, or write a database.

node --check meshuser.js
git diff --check

Against upstream 029b7338ecfeeacc65da3b5a1a4cc069baeb2f65: 6 failures / 16 tests. After the fix: 16 / 16 passed.

Coverage: absent/null/empty links, unrelated and matching groups, mixed matching/unrelated memberships, explicit user IDs, empty allow-list, omitted/true/false policies, token-session rejection, invalid name and expiry.

The local harness was re-run after removing the test directory; all checks still pass. The PR diff now contains only the one-line meshuser.js fix.

Scope and QA

• One production-line change; no UI, dependencies, configuration or schema changes.
• AI-assisted contribution prepared with Hermes; the changed predicate and test assertions were reviewed and the commands above were actually executed.
• These are source-level regression tests, not an end-to-end authorization test on a running server. No production system was changed.
• Opened as draft pending live integration/manual QA, in recognition of the repository's contribution checklist. Upstream CI status is not claimed here.

[si458]

Please can you remove the tests folder

[Toomad23]

Removed the test directory as requested. The diff now contains only the one-line fix in meshuser.js. I kept the regression harness locally and re-ran it: 16/16 tests passed; node --check meshuser.js and git diff --check also pass. The PR description has been updated to make the verification scope clear.