test(plugin-auth): bound the audience-posture find double by presence, not truthiness

The double read the caller's bound as `if (q.limit)`, so `limit: 0` -- a
request for NOTHING -- returned every matched row. Arrived with #11767 after
this branch's ledger was measured; fixed rather than seated, since it is one
line in one file.

Ledger unchanged: 253 files, 168 blind, 32 wrong, 55 unjudged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Author: claude

packages/plugins/plugin-auth/src/audience-posture.test.ts

@@ -83,7 +83,9 @@ const createMemoryEngine = () => {
     async find(name: string, q: any = {}) {
       let out = rows(name).filter((r) => matches(r, q.where));
       if (q.offset) out = out.slice(q.offset);
-      if (q.limit) out = out.slice(0, q.limit);
+      // Presence, not truthiness: `limit: 0` is a request for NOTHING, and `0`
+      // is falsy — `if (q.limit)` answers it with every matched row.
+      if (typeof q.limit === 'number') out = out.slice(0, q.limit);
       return out.map((r) => project(r, q.fields));
     },
     async count(name: string, q: any = {}) {