Create a characterization harness and testable application bootstrap

[DenWin]

Parent testing program: #16. Blocked by the completed analysis in #17.

Evidence

src/index.tsx imports the global database, composes routes, optionally builds CSS, starts listening, and schedules destructive cleanup at module load. src/db/db.ts opens ./data/mydb.sqlite and migrates it at import time. src/helpers/env.ts captures environment values at import time.

These side effects prevent isolated application tests and make configuration, database, storage, clock, scheduler, and startup behavior difficult to control.

Goal

Add preliminary characterization tests around current startup behavior, then refactor only enough to expose a reusable application harness and explicit adapters.

Preliminary characterization before refactoring

• Application starts with current defaults and serves healthcheck.
• WEBROOT prefix and generated/static asset behavior remain unchanged.
• Unknown routes retain current status/error behavior.
• Database creation produces the current schema, version, foreign keys, defaults, and WAL mode.
• Version-0 database migration reaches version 1 without data loss.
• Cleanup is disabled at zero and scheduled at positive intervals.
• Expired jobs use the current age boundary and associated paths.
• Startup dependency reporting does not prevent application startup when a tool is unavailable.

Testability work after characterization

• Separate createApp(dependencies/config) from listen/start-process behavior.
• Provide isolated temporary database and data-directory adapters.
• Parse configuration through an explicit interface rather than import cache manipulation.
• Introduce controllable clock/scheduler adapters for cleanup tests.
• Keep the production adapters as defaults.
• Ensure tests never touch repository or user data directories.

Acceptance criteria

• Preliminary characterization tests pass before structural extraction.
• Tests can create and dispose isolated app instances.
• Tests use unique temporary SQLite and storage roots.
• Importing the application does not have to listen on a port.
• Configuration cases can run independently in one suite.
• Cleanup timing is deterministic without real sleeps.
• Existing observable startup behavior remains covered through public interfaces.
• Mutation or controlled-fault checks demonstrate test sensitivity.