feat(tests): add unit and integration test suite (node:test)

Adds 215 tests across three tiers using node:test + node:assert/strict
(no new test framework dependencies):

- test/tools/ — middleware and utility tests (token, hash, authenticate,
  jsonBody, convertError, validators)
- test/shared/ — DbInterface/BackendDbInterface contract suites reusable
  across backends (users, abodes, residents, apikeys, sessions, auth)
- test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb,
  migrator) + shared suites via SqliteInterface
- test/backends/api/ — ApiInterface unit tests + shared suites via a
  live Koa server backed by SQLite

Also fixes four bugs uncovered by the tests:
- ApiInterface: path params leaked into query string (slice(1) fix)
- ApiInterface: calling res.json() on 204 No Content responses
- SqliteInterface.updateResident: missing comma in SET clause
- WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/shared/auth.ts

@@ -0,0 +1,136 @@
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import type { BackendDbInterface } from "../../src/db/types/DbInterface.js";
+import {
+  NotFoundAbodeError,
+  NotAuthorizedAbodeError,
+  ConflictAbodeError,
+} from "../../src/db/types/errors.js";
+import { hashPassword } from "../../src/util/hash.js";
+
+export function runAuthTests(
+  name: string,
+  getDb: () => Promise<{ db: BackendDbInterface; close(): void }>,
+  createExpiredApikey?: (db: BackendDbInterface, uid: string) => Promise<`at_${string}`>
+): void {
+  describe(`${name}: auth`, async () => {
+    let db: BackendDbInterface;
+    let close: () => void;
+    let email: string;
+    const password = "auth-test-password";
+
+    before(async () => {
+      ({ db, close } = await getDb());
+      email = `auth-user-${Date.now()}@test.example`;
+      const pw = await hashPassword(password);
+      await db.createUser({ email, name: "Auth User", password: pw, flags: {} });
+    });
+
+    after(() => close());
+
+    it("getUserByLogin returns user on correct credentials", async () => {
+      const user = await db.getUserByLogin({ email, password });
+      assert.equal(user.email, email);
+      assert.ok(!("password" in user));
+    });
+
+    it("getUserByLogin throws NotAuthorizedAbodeError for wrong password", async () => {
+      await assert.rejects(
+        () => db.getUserByLogin({ email, password: "wrong-password" }),
+        (err) => {
+          assert.ok(err instanceof NotAuthorizedAbodeError);
+          return true;
+        }
+      );
+    });
+
+    it("getUserByLogin throws NotFoundAbodeError for unknown email", async () => {
+      await assert.rejects(
+        () =>
+          db.getUserByLogin({
+            email: "nobody@nowhere.example",
+            password: "any",
+          }),
+        (err) => {
+          assert.ok(err instanceof NotFoundAbodeError);
+          return true;
+        }
+      );
+    });
+
+    it("getUserByLogin throws ConflictAbodeError for #unset password", async () => {
+      const unsetEmail = `unset-${Date.now()}@test.example`;
+      await db.createUser({
+        email: unsetEmail,
+        name: "Unset User",
+        password: "#unset",
+        flags: {},
+      });
+      await assert.rejects(
+        () => db.getUserByLogin({ email: unsetEmail, password: "any" }),
+        (err) => {
+          assert.ok(err instanceof ConflictAbodeError);
+          return true;
+        }
+      );
+    });
+  });
+
+  describe(`${name}: auth apikey`, async () => {
+    let db: BackendDbInterface;
+    let close: () => void;
+    let uid: string;
+
+    before(async () => {
+      ({ db, close } = await getDb());
+      const pw = await hashPassword("apikey-auth-password");
+      const user = await db.createUser({
+        email: `apikey-auth-${Date.now()}@test.example`,
+        name: "Apikey Auth User",
+        password: pw,
+        flags: {},
+      });
+      uid = user.uid;
+    });
+
+    after(() => close());
+
+    it("getUserByApikey returns [user, apikey] for valid token", async () => {
+      const [, token] = await db.createApikey({
+        uid,
+        name: "Auth Key",
+        permissions: {},
+      });
+      const [user, apikey] = await db.getUserByApikey(token);
+      assert.equal(user.uid, uid);
+      assert.ok(apikey.kid);
+      assert.equal(apikey.uid, uid);
+    });
+
+    it("getUserByApikey throws NotAuthorizedAbodeError for expired key", async (t) => {
+      if (!createExpiredApikey) {
+        t.skip("createExpiredApikey helper not provided for this backend");
+        return;
+      }
+      const token = await createExpiredApikey(db, uid);
+      await assert.rejects(
+        () => db.getUserByApikey(token),
+        (err) => {
+          assert.ok(err instanceof NotAuthorizedAbodeError);
+          return true;
+        }
+      );
+    });
+
+    it("getUserByApikey throws NotFoundAbodeError for unknown token", async () => {
+      const fakeToken = `at_${"0".repeat(32)}` as `at_${string}`;
+      await assert.rejects(
+        () => db.getUserByApikey(fakeToken),
+        (err) => {
+          assert.ok(err instanceof NotFoundAbodeError);
+          return true;
+        }
+      );
+    });
+  });
+}