test(integration): Postgres testcontainers + 4 critical-path tests (rate-limit race, idempotency, cascade, session)

[MBombeck]

Why this matters

Adds a real-Postgres integration test suite (pnpm test:integration) so we have automated regression guards against four classes of bugs that mocked unit tests cannot detect:

• Rate-limit races — src/lib/rate-limit.ts relies on a single atomic SQL UPSERT. A future refactor that splits read+write back into two queries would silently break the cap under concurrency. Test fires 6 parallel requests at a 5-cap window and asserts 5 allowed / 1 denied.
• Idempotency replay-attack contract — mobile retries with the same Idempotency-Key must replay the cached envelope without re-executing the side-effect; the do-not-cache list (401/403/408/429/5xx) must hold so a transient 5xx isn't pinned for 24h. Verified end-to-end against the real idempotency_keys table.
• GDPR Art. 17 cascade delete — prisma.user.delete() must wipe every personal-data row. Schema declares onDelete: Cascade on every personal table; the test seeds them all and asserts zero orphans, plus that audit/feedback rows survive with userId = null (compliance triage).
• Session expiry — getSession() silently purges stale rows before returning null. Worth proving against a real DB so a typo in the WHERE expiresAt < NOW() branch is caught.

How it's wired

• pnpm add -D testcontainers @testcontainers/postgresql (v11.14)
• vitest.integration.config.mts — tests/integration/**, 60s/120s timeouts, single-fork so all four files share one container
• tests/integration/global-setup.ts (new) — vitest globalSetup boots postgres:16-alpine, sets DATABASE_URL, runs prisma migrate deploy once, returns a teardown that stops the container at end-of-run
• tests/integration/setup.ts — per-test helpers: getPrismaClient() (delegates to the app's src/lib/db singleton) and truncateAllTables() for beforeEach() isolation
• .github/workflows/integration.yml runs the suite on every PR to main and on pushes to main
• Default pnpm test continues to exclude tests/integration/** — the unit-test loop stays sub-second

Why globalSetup instead of beforeAll-per-file

Earlier iteration started/stopped a fresh container in each file's beforeAll/afterAll. That works in isolation but the application's Prisma singleton (src/lib/db.ts) caches the connection string at module-load time. Once test file A boots a container, sets DATABASE_URL, and that singleton is built, file A's afterAll stops the container — file B then boots a new container at a new port, but the singleton still points at the dead one. globalSetup keeps one container alive for the whole run, the URL stays stable, and beforeEach truncate gives the per-test isolation.

Test plan

• pnpm typecheck clean
• pnpm test — 658/658 unit tests green, no testcontainers pulled in (1.6s)
• pnpm test:integration — 10/10 pass in 3.9s (was 6/10 with 4 cross-file failures before the globalSetup fix)
• pnpm vitest list --config vitest.integration.config.mts — all 10 tests across 4 files discovered
• CI integration job will run the suite

🤖 Generated with Claude Code