feat(tests): add unit and integration test suite (node:test)

Adds 215 tests across three tiers using node:test + node:assert/strict
(no new test framework dependencies):

- test/tools/ — middleware and utility tests (token, hash, authenticate,
  jsonBody, convertError, validators)
- test/shared/ — DbInterface/BackendDbInterface contract suites reusable
  across backends (users, abodes, residents, apikeys, sessions, auth)
- test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb,
  migrator) + shared suites via SqliteInterface
- test/backends/api/ — ApiInterface unit tests + shared suites via a
  live Koa server backed by SQLite

Also fixes four bugs uncovered by the tests:
- ApiInterface: path params leaked into query string (slice(1) fix)
- ApiInterface: calling res.json() on 204 No Content responses
- SqliteInterface.updateResident: missing comma in SET clause
- WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/shared/users.ts

@@ -0,0 +1,179 @@
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import type { DbInterface } from "../../src/db/types/DbInterface.js";
+import {
+  NotFoundAbodeError,
+  InvalidAbodeError,
+  ReadonlyAbodeError,
+} from "../../src/db/types/errors.js";
+import { hashPassword } from "../../src/util/hash.js";
+
+export function runUserTests(
+  name: string,
+  getDb: () => Promise<{ db: DbInterface; close(): void }>
+): void {
+  describe(`${name}: users`, async () => {
+    let db: DbInterface;
+    let close: () => void;
+    let hashedPw: string;
+
+    before(async () => {
+      ({ db, close } = await getDb());
+      hashedPw = await hashPassword("test-password");
+    });
+
+    after(() => close());
+
+    it("createUser returns a ClientUser without password", async () => {
+      const user = await db.createUser({
+        email: `user-create-${Date.now()}@test.example`,
+        name: "Test User",
+        password: hashedPw,
+        flags: {},
+      });
+      assert.ok(user.uid, "has uid");
+      assert.equal(user.name, "Test User");
+      assert.ok(!("password" in user), "no password field");
+      assert.ok(user.created_at);
+      assert.ok(user.updated_at);
+    });
+
+    it("getUserById returns the created user", async () => {
+      const created = await db.createUser({
+        email: `user-byid-${Date.now()}@test.example`,
+        name: "ById User",
+        password: hashedPw,
+        flags: {},
+      });
+      const found = await db.getUserById(created.uid);
+      assert.equal(found.uid, created.uid);
+      assert.equal(found.name, "ById User");
+    });
+
+    it("getUserById throws NotFoundAbodeError for unknown uid", async () => {
+      await assert.rejects(
+        () => db.getUserById("00000000-0000-0000-0000-000000000000"),
+        (err) => {
+          assert.ok(err instanceof NotFoundAbodeError);
+          return true;
+        }
+      );
+    });
+
+    it("getUserByEmail returns the created user", async () => {
+      const email = `user-byemail-${Date.now()}@test.example`;
+      await db.createUser({ email, name: "ByEmail User", password: hashedPw, flags: {} });
+      const found = await db.getUserByEmail(email);
+      assert.equal(found.email, email);
+    });
+
+    it("getUserByEmail throws NotFoundAbodeError for unknown email", async () => {
+      await assert.rejects(
+        () => db.getUserByEmail("nobody@nowhere.example"),
+        (err) => {
+          assert.ok(err instanceof NotFoundAbodeError);
+          return true;
+        }
+      );
+    });
+
+    it("listUsers includes the created user", async () => {
+      const email = `user-list-${Date.now()}@test.example`;
+      const created = await db.createUser({
+        email,
+        name: "Listed User",
+        password: hashedPw,
+        flags: {},
+      });
+      const users = await db.listUsers();
+      assert.ok(Array.isArray(users));
+      const found = users.find((u) => u.uid === created.uid);
+      assert.ok(found, "created user appears in listUsers");
+    });
+
+    it("updateUser updates the name", async () => {
+      const created = await db.createUser({
+        email: `user-update-${Date.now()}@test.example`,
+        name: "Before Update",
+        password: hashedPw,
+        flags: {},
+      });
+      const updated = await db.updateUser({ uid: created.uid, name: "After Update" });
+      assert.equal(updated.uid, created.uid);
+      assert.equal(updated.name, "After Update");
+    });
+
+    it("updateUser with no fields throws InvalidAbodeError", async () => {
+      const created = await db.createUser({
+        email: `user-noupdate-${Date.now()}@test.example`,
+        name: "No Update",
+        password: hashedPw,
+        flags: {},
+      });
+      await assert.rejects(
+        () => db.updateUser({ uid: created.uid }),
+        (err) => {
+          assert.ok(err instanceof InvalidAbodeError);
+          return true;
+        }
+      );
+    });
+
+    it("deleteUserById removes the user", async () => {
+      const created = await db.createUser({
+        email: `user-delete-${Date.now()}@test.example`,
+        name: "To Delete",
+        password: hashedPw,
+        flags: {},
+      });
+      await db.deleteUserById(created.uid);
+      await assert.rejects(
+        () => db.getUserById(created.uid),
+        (err) => {
+          assert.ok(err instanceof NotFoundAbodeError);
+          return true;
+        }
+      );
+    });
+
+    it("deleteUserById throws NotFoundAbodeError for unknown uid", async () => {
+      await assert.rejects(
+        () => db.deleteUserById("00000000-0000-0000-0000-000000000000"),
+        (err) => {
+          assert.ok(err instanceof NotFoundAbodeError);
+          return true;
+        }
+      );
+    });
+  });
+
+  describe(`${name}: users readonly`, async () => {
+    let db: DbInterface;
+    let close: () => void;
+    let hashedPw: string;
+
+    before(async () => {
+      ({ db, close } = await getDb());
+      hashedPw = await hashPassword("test-password");
+    });
+
+    after(() => close());
+
+    it("createUser on readonly db throws ReadonlyAbodeError", async () => {
+      if (!db.readonly) return;
+      await assert.rejects(
+        () =>
+          db.createUser({
+            email: "readonly@test.example",
+            name: "Readonly",
+            password: hashedPw,
+            flags: {},
+          }),
+        (err) => {
+          assert.ok(err instanceof ReadonlyAbodeError);
+          return true;
+        }
+      );
+    });
+  });
+}