fix(tests): address review gaps in test suite

- Add tsconfig.test.json + typecheck:test script so test/ is type-checked;
  fixes real type errors it surfaced (hashedPw typing, PartialUser|ClientUser
  narrowing for .email).
- Add HTTP-level auth-http.test.ts for the api backend covering
  login/session-cookie/logout/clear-sessions/bearer-apikey flows, since
  ApiInterface doesn't implement the session/login methods needed to run the
  shared session/auth suites directly.
- Make the readonly-db test in shared/users.ts actually construct a readonly
  db instance (previously a no-op that never ran) via a new getReadonlyDb
  parameter, wired up for both sqlite and api backends.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

test/backends/sqlite/index.test.ts

@@ -1,6 +1,6 @@
 import type { BackendDbInterface } from "../../../src/db/types/DbInterface.js";
 import { SqliteInterface } from "../../../src/db/sqlite/SqliteInterface.js";
-import { createTestDb } from "../../helpers/sqlite.js";
+import { createTestDb, createReadonlyTestDb } from "../../helpers/sqlite.js";
 import { runUserTests } from "../../shared/users.js";
 import { runAbodeTests } from "../../shared/abodes.js";
 import { runResidentTests } from "../../shared/residents.js";
@@ -30,7 +30,7 @@ async function createExpiredApikey(
   return token;
 }
 
-runUserTests("sqlite", createTestDb);
+runUserTests("sqlite", createTestDb, createReadonlyTestDb);
 runAbodeTests("sqlite", createTestDb);
 runResidentTests("sqlite", createTestDb);
 runApikeyTests("sqlite", createTestDb);