align delegate-auth docs with merged example tests

Author: leighmcculloch

docs/build/smart-contracts/example-contracts/delegate-auth.mdx

@@ -60,8 +60,12 @@ make test
 Expected output:
 
 ```
-running 1 test
+running 3 tests
+test test::test_empty_delegates_is_rejected ... ok
+test test::test_unknown_delegate_is_rejected ... ok
 test test::test ... ok
+
+test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
 ```
 
 [setup]: ../getting-started/setup.mdx
@@ -252,6 +256,8 @@ After the call, the test asserts two things:
 1. `env.auths()` shows only the account authorizing `protected` — delegating to `DelegateAccount` is not recorded as a separate top-level authorization.
 2. `DelegateAccount`'s `ApprovedContexts` storage contains the same contract context, confirming the delegation actually reached it.
 
+Two further tests cover the rejection paths: `test_unknown_delegate_is_rejected` attaches a delegate the account never registered, and `test_empty_delegates_is_rejected` attaches none at all. In both, `Protected::protected` fails. The caller only sees a generic `Error(Auth, InvalidAction)`, because the host escalates any failed `__check_auth` to that — the account's own error code does not propagate to the return value. To assert the account rejected the call for its own reason, the tests read the host's diagnostic events with `env.host().get_diagnostic_events()` and match the recorded `Error(Contract, #n)` — `UnknownDelegate` and `InsufficientDelegates` respectively.
+
 :::note
 
 Testing delegated auth via `env.try_invoke_contract_check_auth` is not supported. Use `env.set_auths` with `SorobanAddressCredentialsWithDelegates` and a wrapper contract call instead, as shown in the test.