fix(tests): address review gaps in test suite

- Add tsconfig.test.json + typecheck:test script so test/ is type-checked;
  fixes real type errors it surfaced (hashedPw typing, PartialUser|ClientUser
  narrowing for .email).
- Add HTTP-level auth-http.test.ts for the api backend covering
  login/session-cookie/logout/clear-sessions/bearer-apikey flows, since
  ApiInterface doesn't implement the session/login methods needed to run the
  shared session/auth suites directly.
- Make the readonly-db test in shared/users.ts actually construct a readonly
  db instance (previously a no-op that never ran) via a new getReadonlyDb
  parameter, wired up for both sqlite and api backends.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

package.json

@@ -23,7 +23,9 @@
     "test": "node --import tsx/esm --import ./src/meta/dev/register.ts --test $(find test -name '*.test.ts' | sort)",
     "test:backends": "node --import tsx/esm --import ./src/meta/dev/register.ts --test $(find test/backends -name '*.test.ts' | sort)",
     "test:shared": "node --import tsx/esm --import ./src/meta/dev/register.ts --test $(find test/backends -name 'index.test.ts' | sort)",
-    "test:tools": "node --import tsx/esm --import ./src/meta/dev/register.ts --test $(find test/tools -name '*.test.ts' | sort)"
+    "test:tools": "node --import tsx/esm --import ./src/meta/dev/register.ts --test $(find test/tools -name '*.test.ts' | sort)",
+    "typecheck": "tsc --noEmit",
+    "typecheck:test": "tsc --noEmit -p tsconfig.test.json"
   },
   "dependencies": {
     "@koa/bodyparser": "^6.0.0",