Add characterization tests ahead of the merge into subscriptions

[johnworth]

Summary

QMS had no tests at all. This adds a suite that runs the real router against a
real PostgreSQL instance (testcontainers, stock postgres:17, the repo's own
migrations), so the recorded responses describe what the service actually does
rather than what a mock says it does.

It exists to make the planned merge of QMS into cyverse-de/subscriptions
provably behavior-preserving: the same tests move with the code and must pass
unchanged against the merged binary. That is the merge's acceptance criterion.

Coverage is scoped to the eight /v1 path shapes terrain actually calls
(terrain/src/terrain/clients/qms.clj), asserting the full
{result, error, status} envelope terrain's route schemas require — not to
100% of the API, since the rest has no live caller.

• Golden tests for the terrain-facing routes, with database-generated UUIDs
  and timestamps redacted. The migration-seeded UUIDs are asserted exactly, so
  a golden still pins which plan or resource type a response refers to.
• Integration tests for the behaviors the subscriptions service implements
  differently — audit rows in updates, quota addressing, subscription
  deactivation — since those are where a merge silently changes semantics.
• Unit tests for the plan-rate and quota-default selectors, which are
  duplicated in both codebases; only one implementation survives the merge.

Migrations are now embedded and applied through the iofs source driver
instead of file://$PWD/migrations, so neither the tests nor the service
depend on the working directory.

Bugs this surfaced

All three are recorded as-is with a KNOWN BUG comment rather than fixed,
so the merge cannot change them by accident. Each should be fixed as its own
change, updating the corresponding assertion in the same commit.

1. POST /v1/subscriptions?force=false fails for every request and reports
   success. GetActiveSubscriptionForDate builds
   .Or("? > subscriptions.effective_start_date AND ...") with no argument for
   the placeholder, so PostgreSQL rejects the statement with
   syntax error at or near ">". The handler turns that into a per-item
   failure_reason and still answers 200, so terrain's
   POST /terrain/admin/qms/subscriptions silently creates nothing whenever
   force isn't set. This also means the upgrade-comparison rule the unforced
   path exists to implement has never run.
2. Every updates row records ADD, even for a SET. The operation is
   looked up with tx.First(&model.UpdateOperation{Name: usage.UpdateType}),
   but GORM's First only filters on the primary key, so it returns whichever
   row sorts first. The running total in usages is correct; only the audit
   trail misreports. The same unreachable lookup is why an invalid update type
   returns 500 instead of 400.
3. The two subscribe paths store different usernames for the same person.
   POST /v1/subscriptions passes req.Username through untouched while every
   other endpoint trims the configured suffix, so an admin bulk-subscribing
   user@domain creates a second user row that the user's own
   /terrain/qms/user/* routes never see. Existing databases likely hold
   duplicate rows that need reconciling.

Also worth noting, and captured in a golden: GET /v1/users/{username}/plan
creates the user and subscribes them to the default plan when QMS hasn't seen
them, so the read has a write side effect and returns 200 rather than 404.
That one appears intentional — terrain relies on it — so it is recorded as
expected behavior.

Notes

• QMS had no test workflow; one is added. The lint pin moves from
  @v0.0.4/go1.21 to @v0.4.1/go1.25, and the newer analyzers flag four
  redundant type declarations in existing code, fixed here so the bump lands
  green.
• testcontainers runs on GitHub-hosted runners with no workflow changes, so
  unlike the env-var-gated database tests elsewhere in the org, these actually
  execute in CI.
• There is deliberately no golden regeneration flag. A missing golden is
  written and the test still fails, so a new baseline is committed
  deliberately; an existing one is never overwritten.

Testing

go test ./... and golangci-lint run ./... (v2.12.2, the CI pin) are clean;
the suite was run repeatedly to confirm the goldens are stable.

🤖 Generated with Claude Code