test(security): pin the shrunken audit allowlist

The allowlist dropped the accessor and crypto modules — neither holds a query —
but the audit's own test still asserted their exemption. It now asserts the
inverse: only credential-service and slack are exempt, and the other two are
audited like any file. This test runs from the root test chain, which is why
the apps/sim suite stayed green while CI went red.

Author: waleedlatif1

scripts/check-account-token-access.test.ts

@@ -87,11 +87,13 @@ describe('auditSource', () => {
     )
   })
 
-  it('exempts the token-aware modules', () => {
+  it('exempts only the two modules that genuinely touch the table', () => {
     const source = 'await db.select().from(account)\nconst t = account.accessToken'
-    expect(auditSource('apps/sim/lib/oauth/account-tokens.ts', source)).toEqual([])
     expect(auditSource('apps/sim/lib/oauth/credential-service.ts', source)).toEqual([])
     expect(auditSource('apps/sim/lib/oauth/slack.ts', source)).toEqual([])
+    /** The accessor and crypto modules hold no queries, so they are audited like any file. */
+    expect(auditSource('apps/sim/lib/oauth/account-tokens.ts', source)).toHaveLength(2)
+    expect(auditSource('apps/sim/lib/oauth/account-token-crypto.ts', source)).toHaveLength(2)
   })
 
   describe('annotation', () => {