fix(tests): address review gaps in test suite

- Add tsconfig.test.json + typecheck:test script so test/ is type-checked;
  fixes real type errors it surfaced (hashedPw typing, PartialUser|ClientUser
  narrowing for .email).
- Add HTTP-level auth-http.test.ts for the api backend covering
  login/session-cookie/logout/clear-sessions/bearer-apikey flows, since
  ApiInterface doesn't implement the session/login methods needed to run the
  shared session/auth suites directly.
- Make the readonly-db test in shared/users.ts actually construct a readonly
  db instance (previously a no-op that never ran) via a new getReadonlyDb
  parameter, wired up for both sqlite and api backends.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

test/backends/api/index.test.ts

@@ -33,7 +33,20 @@ async function getApiDb() {
   };
 }
 
-runUserTests("api", getApiDb);
+async function getReadonlyApiDb() {
+  const { db: sqliteDb, close: closeSqlite } = await createTestDb();
+  const server = await createTestServer(sqliteDb);
+  const api = new ApiInterface(server.url, { readonly: true });
+  return {
+    db: api,
+    close: async () => {
+      await server.close();
+      closeSqlite();
+    },
+  };
+}
+
+runUserTests("api", getApiDb, getReadonlyApiDb);
 runAbodeTests("api", getApiDb);
 runResidentTests("api", getApiDb);
 runApikeyTests("api", getApiDb);