feat(tests): add unit and integration test suite (node:test)

Adds 215 tests across three tiers using node:test + node:assert/strict
(no new test framework dependencies):

- test/tools/ — middleware and utility tests (token, hash, authenticate,
  jsonBody, convertError, validators)
- test/shared/ — DbInterface/BackendDbInterface contract suites reusable
  across backends (users, abodes, residents, apikeys, sessions, auth)
- test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb,
  migrator) + shared suites via SqliteInterface
- test/backends/api/ — ApiInterface unit tests + shared suites via a
  live Koa server backed by SQLite

Also fixes four bugs uncovered by the tests:
- ApiInterface: path params leaked into query string (slice(1) fix)
- ApiInterface: calling res.json() on 204 No Content responses
- SqliteInterface.updateResident: missing comma in SET clause
- WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/tools/convertError.test.ts

@@ -0,0 +1,74 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { convertError } from "../../src/webapi/middleware/convertError.js";
+import {
+  NotFoundAbodeError,
+  NotAuthorizedAbodeError,
+  ConflictAbodeError,
+  InvalidAbodeError,
+  ReadonlyAbodeError,
+} from "../../src/db/types/errors.js";
+
+function makeCtx() {
+  return { status: 200, body: null as unknown };
+}
+
+async function runWithError(err: unknown) {
+  const ctx = makeCtx();
+  await convertError(ctx as any, async () => {
+    throw err;
+  });
+  return ctx;
+}
+
+describe("convertError middleware", () => {
+  it("does not interfere when next succeeds", async () => {
+    const ctx = makeCtx();
+    let nextCalled = false;
+    await convertError(ctx as any, async () => { nextCalled = true; });
+    assert.equal(nextCalled, true);
+    assert.equal(ctx.status, 200);
+  });
+
+  it("NotFoundAbodeError → 404 not_found", async () => {
+    const ctx = await runWithError(new NotFoundAbodeError());
+    assert.equal(ctx.status, 404);
+    assert.deepEqual(ctx.body, { ok: false, error: "not_found" });
+  });
+
+  it("NotAuthorizedAbodeError → 401 not_authorized", async () => {
+    const ctx = await runWithError(new NotAuthorizedAbodeError());
+    assert.equal(ctx.status, 401);
+    assert.deepEqual(ctx.body, { ok: false, error: "not_authorized" });
+  });
+
+  it("ConflictAbodeError → 409 conflict", async () => {
+    const ctx = await runWithError(new ConflictAbodeError());
+    assert.equal(ctx.status, 409);
+    assert.deepEqual(ctx.body, { ok: false, error: "conflict" });
+  });
+
+  it("InvalidAbodeError → 400 invalid", async () => {
+    const ctx = await runWithError(new InvalidAbodeError());
+    assert.equal(ctx.status, 400);
+    assert.deepEqual(ctx.body, { ok: false, error: "invalid" });
+  });
+
+  it("ReadonlyAbodeError → 403 readonly", async () => {
+    const ctx = await runWithError(new ReadonlyAbodeError());
+    assert.equal(ctx.status, 403);
+    assert.deepEqual(ctx.body, { ok: false, error: "readonly" });
+  });
+
+  it("unknown Error → 500 unknown", async () => {
+    const ctx = await runWithError(new Error("something went wrong"));
+    assert.equal(ctx.status, 500);
+    assert.deepEqual(ctx.body, { ok: false, error: "unknown" });
+  });
+
+  it("non-Error thrown → 500 unknown", async () => {
+    const ctx = await runWithError("string error");
+    assert.equal(ctx.status, 500);
+    assert.deepEqual(ctx.body, { ok: false, error: "unknown" });
+  });
+});