test(mcp): stub the writer replica the fresh-policy reads use

reload_admitted_user now passes check_db_only through to get_user_object,
so the user row is read from writer_db. Point the mocks at the replica the
code actually reads and give each parametrized case its own user id.

tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py

@@ -7847,7 +7847,7 @@ async def test_load_active_user_by_id_reads_the_row_from_the_database_not_the_ca
         key="fresh-jwt-user", value=LiteLLM_UserTable(user_id="fresh-jwt-user", teams=[]), model_type=LiteLLM_UserTable
     )
     prisma = MagicMock()
-    prisma.db.litellm_usertable.find_unique = AsyncMock(
+    prisma.writer_db.litellm_usertable.find_unique = AsyncMock(
         return_value=LiteLLM_UserTable(user_id="fresh-jwt-user", teams=["team-a"])
     )
     proxy_globals.user_api_key_cache = cache

tests/test_litellm/proxy/_experimental/mcp_server/test_proxy_api_credentials.py

@@ -139,7 +139,7 @@ async def test_mint_reads_the_users_teams_from_the_database_not_a_stale_cached_r
         key="stale-cache-user", value=_user(user_id="stale-cache-user", teams=[]), model_type=LiteLLM_UserTable
     )
     prisma = MagicMock()
-    prisma.db.litellm_usertable.find_unique = AsyncMock(
+    prisma.writer_db.litellm_usertable.find_unique = AsyncMock(
         return_value=_user(user_id="stale-cache-user", teams=["team-a"])
     )
     monkeypatch.setattr(proxy_server, "user_api_key_cache", cache)
@@ -164,7 +164,7 @@ async def test_mint_refuses_a_user_scim_deactivated_after_the_cache_last_saw_the
         key="deactivated-user", value=_user(user_id="deactivated-user", teams=["team-a"]), model_type=LiteLLM_UserTable
     )
     prisma = MagicMock()
-    prisma.db.litellm_usertable.find_unique = AsyncMock(
+    prisma.writer_db.litellm_usertable.find_unique = AsyncMock(
         return_value=_user(user_id="deactivated-user", teams=["team-a"], metadata={"scim_active": False})
     )
     monkeypatch.setattr(proxy_server, "user_api_key_cache", cache)

tests/test_litellm/proxy/management_endpoints/test_mcp_management_endpoints.py

@@ -7679,7 +7679,7 @@ class TestConnectedAppViewAnnotation:
 
         flags = {server.server_id: server.connected_app_reachable for server in result}
         assert flags == {"server-1": True, "server-2": False}
-        reload_mock.assert_awaited_once_with("test_user_id")
+        reload_mock.assert_awaited_once_with("test_user_id", requires_fresh_policy=False)
         mock_manager.get_allowed_mcp_servers.assert_awaited_once_with(admitted_auth)
 
     @pytest.mark.asyncio
@@ -9653,7 +9653,7 @@ class TestMCPServerResolutionCharacterization:
         server_id: str,
     ) -> tuple[MagicMock, MCPServerManager, UserAPIKeyAuth]:
         team_id: Final = UI_SESSION_TOKEN_TEAM_ID if grant_route == "direct user object_permission" else "lit3974_team"
-        user_id: Final = "lit3974_direct_user"
+        user_id: Final = f"{server_id}:{grant_route}:user"
         key_permission: Final = LiteLLM_ObjectPermissionTable(
             object_permission_id=f"lit3974_{grant_route}_key_permission",
             mcp_servers=None,