Backfill regression tests for this session's bug fixes

[tayebmokni]

Summary

This session shipped ~13 bug fixes that were verified by hand in the browser but added zero new tests. The next refactor will likely re-break some of them. Minimum regression coverage to add:

Admin (vitest)

1. `posts/page.test.tsx` — add cases for the response adapter covering (a) `{data:[...]}` envelope, (b) `{posts:[...]}` legacy envelope, (c) `data:null`, (d) HTTP 400 with `status=any`, (e) malformed JSON. Currently only 2 broad render tests; none exercise the adapter.
2. `PostListClient.test.tsx:96-102` — update href assertion to `/posts/pN` (broken by the postEditHref rename, separate issue) and add a sibling test asserting the comments table doesn't link to the old path.
3. `media/page.test.tsx`, `MediaGrid.test.tsx`, `FolderTree.test.tsx` — assert renders without crash when API returns `data:null` (locks in the null-coercion fixes).
4. New: `lib/api-client.test.ts` — assert server-side resolves to GONEXT_API_URL, client-side resolves to NEXT_PUBLIC_API_URL or empty (the URL resolution regression REGRESSION: apiBaseUrl in admin api-client may bake server URL into client bundles #498 will need this regardless).

API (go test)

5. `cmd/server/adapters_test.go` — assert userLookupByEmail projects users.meta.roles into UserRecord.Roles.
6. `auth/login/service_test.go` — add a case asserting roles flow from UserRecord through completeLogin into Sessions.Create data map. Same for finalizeTOTP path (which currently passes nil — separate regression REGRESSION: TOTP finalize path drops user roles → super_admin loses admin on re-login #496).