Add pytest coverage for broker auth/token/attestation/limits

[adamcohenhillel]

services/model-broker/ has no Python unit tests. scripts/smoke-test-model-broker.sh covers only happy-path HTTP against pre-provider paths.

Coverage gaps to close

• Token expiry (validate_signed_token).
• Tampered signatures (bit-flipped payload, wrong HMAC key version).
• Device-HMAC attestation with clock skew (accept vs reject window).
• Rate limiter concurrency (once #broker-rate-limit lands).
• Admin-token compare_digest paths.
• Privacy check (count_input_images) on adversarial payloads.

Add services/model-broker/tests/ with pytest, run in ci.yml (broker code changes only).

Size: M