fix: quota pending sign-ins and registrations per address, keep young clients, write the store off the loop (SEC-09)

tests/test_oauth_provider.py

@@ -142,6 +142,7 @@ async def test_client_cap_evicts_the_least_recently_used_client_without_sessions
     await provider.register_client(client_info("newer"))
     oauth.clock.advance(5)
     await provider.get_client("old")  # used recently: "newer" is now least recently used
+    oauth.clock.advance(provider_module.PENDING_TTL)  # none of them is young any more
 
     await provider.register_client(client_info("newest"))