Cover all branches: user without realm gets @pam appended, user with realm unchanged, token auth skips user modification, empty user handling, and fingerprint/verifySSL preservation. Coverage improved from 66.7% to 100%.