Note the test-teardown and token findings

Running the backend suite against the development database wipes its users,
and the old InfluxDB token turns out to be in pushed history rather than only
in the working tree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WzrvW7rjQbynnhF6pxh6i

NOTEPAD.md

@@ -8,6 +8,12 @@ Deferring because out of scope is fine, but don't mention deferring than.
 
 ## Open
 
+- BUG/API: `pytest tests/` deletes every user on teardown (`tests/conftest.py`), so running
+  it against the development database logs you out of the running app. Point tests at their
+  own database, or reseed with `init_db` afterwards.
+- CHORE/FLOW: the InfluxDB token committed in the old `flow/nodes/influx_test.py` is in
+  pushed history (`d222ce5`). Rotate it in InfluxDB; removing it from history needs a
+  rewrite of published commits.
 - BUG/UI: six template Playwright specs fail on validation copy that no longer matches
   (`login`, `sign-up`, `reset-password`, `user-settings` theme persistence). Unrelated to
   the flow editor, which passes; fix or delete them with the `Item` cleanup.