test: retire stale connections scenario tests (command removed in #221)

The `hotdata connections` command was removed in #221 (all commands scoped to the
active database), but two scenario tests kept calling it:

- `tests/connections_read.rs` — calls the removed `connections list`/`<id>`. It
  only existed to satisfy scenario-parity's file-existence check and skips in CI
  (no `HOTDATA_SDK_TEST_CONNECTION_ID`), so it was dead. The scenario has no CLI
  equivalent; a companion www.hotdata.dev PR opts the CLI out of it. Deleted.

- `tests/auth_unknown_workspace.rs` — a security scenario (a fabricated workspace
  id must be rejected, no cross-workspace leak). It also called `connections
  list`, so it exited non-zero at *arg-parse* — passing for the wrong reason and
  never actually exercising the server rejection. Switched to `databases list`, a
  real workspace-scoped listing that reaches the gateway with the fabricated
  workspace id, restoring genuine coverage.

Depends on hotdata-dev/www.hotdata.dev#290 (opts the CLI out of connections_read)
merging first, or scenario-parity will still require the deleted file.

Author: eddietejeda

tests/auth_unknown_workspace.rs

@@ -5,6 +5,12 @@
 //! real api key, then sends the fabricated id as the gateway-enforced
 //! `X-Workspace-Id`; the server responds 4xx (403/404). We assert the command
 //! exits non-zero and never prints a successful listing.
+//!
+//! Uses `databases list` — a workspace-scoped listing that returns a JSON array
+//! — so a missing rejection would surface as leaked cross-workspace data. (The
+//! scenario's `ops: ["*"]` allows any op; this is a real command that reaches
+//! the gateway with the fabricated workspace id, unlike the removed
+//! `connections list` this test previously called, which failed at arg-parse.)
 
 mod common;
 
@@ -21,13 +27,13 @@ fn auth_unknown_workspace() {
     // Real api key (no HOTDATA_WORKSPACE lock) + fabricated workspace via -w.
     let output = cli
         .cmd_unlocked_workspace()
-        .args(["connections", "list", "-w", &fake_workspace, "-o", "json"])
+        .args(["databases", "list", "-w", &fake_workspace, "-o", "json"])
         .output()
         .expect("failed to spawn hotdata binary");
 
     assert!(
         !output.status.success(),
-        "connections list with fabricated workspace {fake_workspace} must fail \
+        "databases list with fabricated workspace {fake_workspace} must fail \
          (potential cross-workspace leak); stdout:\n{}",
         String::from_utf8_lossy(&output.stdout)
     );
@@ -39,6 +45,6 @@ fn auth_unknown_workspace() {
             .ok()
             .and_then(|v| v.as_array().map(|a| !a.is_empty()))
             != Some(true),
-        "fabricated workspace {fake_workspace} leaked a connection listing:\n{stdout}"
+        "fabricated workspace {fake_workspace} leaked a database listing:\n{stdout}"
     );
 }