Migrates the remaining 9 server tests to vitest-pool-workers and removes
the fragile SQL-parsing mock DB. Pure-library tests (rate-limit,
install-script, validation) and archtests stay on happy-dom — they don't
need D1 or the Workers runtime.

Migrated to pool-workers in this commit:
- src/lib/server/auth.test.ts (JWT + DB-backed getCurrentUser)
- src/routes/api/auth/cli/start/server.test.ts
- src/routes/api/auth/cli/approve/server.test.ts
- src/routes/api/configs/[slug]/server.test.ts
- src/routes/api/configs/[slug]/revisions/server.test.ts
- src/routes/[username]/[slug]/install/server.test.ts
- src/routes/[username]/[slug]/config/server.test.ts
- src/smoke-tests/{cli-auth-flow,config-crud,critical-paths}.test.ts

The CLI auth-flow smoke test now exercises the real approve endpoint
end-to-end (previously had to fake it because the mock couldn't handle
datetime expressions). The config-crud smoke test now verifies UPDATE
side effects in the DB (previously couldn't — mock didn't honor
COALESCE).

Infrastructure:
- Adds src/lib/test/call.ts helper to cut RequestEvent boilerplate
- Extends call() with params/clientAddress for routes that need them
- Deletes src/lib/test/db-mock.ts (~390 lines of SQL-parsing mock)
- Deletes src/lib/test/setup.ts (process.env shims no longer needed)
- Deletes src/lib/test/helpers.ts (unused after migration)
- Trims src/lib/test/fixtures.ts to data-only exports
- Adds @cloudflare/vitest-pool-workers/types to tsconfig.json
- Wires npm test / test:run / test:coverage to run both configs;
  adds test:happy-dom and test:workers for targeted runs

Final test layout: 181 tests on pool-workers (14 files, real D1 +
Workers runtime), 99 tests on happy-dom (6 files, pure libs +
archtests). Both green; full npm run validate clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI Node 20 → 22 because @cloudflare/vitest-pool-workers transitively
pulls @cloudflare/kv-asset-handler@0.5.0 which requires Node ≥22.

knip drift sensor was flagging every `cloudflare:test` import as an
unlisted dependency (it doesn't grok the virtual-module convention).
Added `cloudflare` to knip.json's ignoreDependencies so the sensor stops
opening tracking issues for this. The package itself is provided by
@cloudflare/vitest-pool-workers and not a real dependency entry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

workerd has no node:inspector/promises module, which @vitest/coverage-v8
requires. Coverage now runs only on the happy-dom suite; the
pool-workers suite still runs (verifying behavior) but does not
contribute to the coverage report. Trade-off: covered % drops because
many tests moved to pool-workers. Acceptable — tests still execute,
and switching the coverage backend (e.g. istanbul) is a separate
decision.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>