feat(tests): add unit and integration test suite (node:test)

Adds 215 tests across three tiers using node:test + node:assert/strict
(no new test framework dependencies):

- test/tools/ — middleware and utility tests (token, hash, authenticate,
  jsonBody, convertError, validators)
- test/shared/ — DbInterface/BackendDbInterface contract suites reusable
  across backends (users, abodes, residents, apikeys, sessions, auth)
- test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb,
  migrator) + shared suites via SqliteInterface
- test/backends/api/ — ApiInterface unit tests + shared suites via a
  live Koa server backed by SQLite

Also fixes four bugs uncovered by the tests:
- ApiInterface: path params leaked into query string (slice(1) fix)
- ApiInterface: calling res.json() on 204 No Content responses
- SqliteInterface.updateResident: missing comma in SET clause
- WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/db/api/ApiInterface.ts

@@ -55,7 +55,7 @@ export class ApiInterface implements DbInterface {
         .map((part) => {
           if (part.startsWith(":")) {
             const value = remaining.get(part.slice(1));
-            remaining.delete(part);
+            remaining.delete(part.slice(1));
             if (value === undefined)
               throw new Error(`Missing ${part} in params`);
             return encodeURIComponent(value);
@@ -113,6 +113,7 @@ export class ApiInterface implements DbInterface {
           throw new Error(`${res.status} ${res.statusText} ${text}`);
       }
     }
+    if (res.status === 204) return undefined as T;
     return res.json();
   }
 

src/db/sqlite/SqliteInterface.ts

@@ -319,7 +319,7 @@ export class SqliteInterface implements BackendDbInterface {
             UPDATE "residents"
             SET
               "updated_at" = datetime('now', 'localtime', 'subsec'),
-              "updated_by" = ${{ uuid: ctx.uid }}
+              "updated_by" = ${{ uuid: ctx.uid }},
               ${joinSql(updates, sql`, `)}
             WHERE
               "uid" = ${{ uuid: resident.uid }}

src/db/sqlite/impl/better-sqlite3.ts

@@ -10,6 +10,7 @@ function getDatabase(
 ): sqlite.Database {
   if (!natives.sqlite) throw new Error("No natives found for better-sqlite3");
   options = { ...options };
+  if (typeof options.readonly !== "boolean") delete options.readonly;
   if (typeof options.timeout !== "number") delete options.timeout;
   const db = new Sqlite(path, { ...options, nativeBinding: natives.sqlite });
   db.exec(pragma);