fix(tests): address review gaps in test suite

- Add tsconfig.test.json + typecheck:test script so test/ is type-checked;
  fixes real type errors it surfaced (hashedPw typing, PartialUser|ClientUser
  narrowing for .email).
- Add HTTP-level auth-http.test.ts for the api backend covering
  login/session-cookie/logout/clear-sessions/bearer-apikey flows, since
  ApiInterface doesn't implement the session/login methods needed to run the
  shared session/auth suites directly.
- Make the readonly-db test in shared/users.ts actually construct a readonly
  db instance (previously a no-op that never ran) via a new getReadonlyDb
  parameter, wired up for both sqlite and api backends.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

test/shared/users.ts

@@ -10,12 +10,13 @@ import { hashPassword } from "../../src/util/hash.js";
 
 export function runUserTests(
   name: string,
-  getDb: () => Promise<{ db: DbInterface; close(): void }>
+  getDb: () => Promise<{ db: DbInterface; close(): void }>,
+  getReadonlyDb?: () => Promise<{ db: DbInterface; close(): void }>
 ): void {
   describe(`${name}: users`, async () => {
     let db: DbInterface;
     let close: () => void;
-    let hashedPw: string;
+    let hashedPw: Awaited<ReturnType<typeof hashPassword>>;
 
     before(async () => {
       ({ db, close } = await getDb());
@@ -64,6 +65,7 @@ export function runUserTests(
       const email = `user-byemail-${Date.now()}@test.example`;
       await db.createUser({ email, name: "ByEmail User", password: hashedPw, flags: {} });
       const found = await db.getUserByEmail(email);
+      assert.ok("email" in found, "result includes email");
       assert.equal(found.email, email);
     });
 
@@ -150,17 +152,21 @@ export function runUserTests(
   describe(`${name}: users readonly`, async () => {
     let db: DbInterface;
     let close: () => void;
-    let hashedPw: string;
+    let hashedPw: Awaited<ReturnType<typeof hashPassword>>;
 
     before(async () => {
-      ({ db, close } = await getDb());
+      if (getReadonlyDb) ({ db, close } = await getReadonlyDb());
       hashedPw = await hashPassword("test-password");
     });
 
-    after(() => close());
+    after(() => close?.());
 
-    it("createUser on readonly db throws ReadonlyAbodeError", async () => {
-      if (!db.readonly) return;
+    it("createUser on readonly db throws ReadonlyAbodeError", async (t) => {
+      if (!getReadonlyDb) {
+        t.skip("getReadonlyDb helper not provided for this backend");
+        return;
+      }
+      assert.ok(db.readonly, "test db is readonly");
       await assert.rejects(
         () =>
           db.createUser({