test: add unit, API, component and end-to-end test suites

The repo had no automated tests. Every change was verified by hand.

Adds four layers, 2023 tests in total, runnable with one command:

- 1191 unit tests over the pure logic in lib/, including the full
  computeProjectAccess permission matrix and the billing gate
- 167 component and hook tests in jsdom, covering the hooks that hold
  real logic rather than presentational wrappers
- 647 API integration tests against a real Postgres, with only auth()
  mocked, including a data-driven sweep asserting that none of the 60
  route modules answers 2xx to an unauthenticated caller
- 18 Playwright specs driving a real browser against a real build

Infrastructure: vitest.config.ts with three projects, a disposable
Postgres and MinIO in docker-compose.test.yml, factories and helpers
under tests/, scripts/test.sh as the single entry point, a pre-push
hook running bun run verify, and CI split into check, test and e2e jobs.

The test database is built with prisma db push plus a replay of the
hand-written SQL, because prisma migrate deploy cannot build this schema
from empty: the migration history has no captured baseline. This mirrors
what scripts/docker-db-bootstrap.ts already does in production, and
tests/setup/db-global.ts carries a drift guard so a new migration fails
the run until someone reviews it.

Production code is unchanged apart from one pure-function extraction out
of use-video-player.ts, which was too large to test in jsdom.

Several tests pin behaviour that looks wrong, each marked KNOWN BUG in
place. TESTING.md section 12 records where the plan turned out to be
wrong, and AGENTS.md now states which layer a change needs a test in.

tests/e2e/billing-gate.spec.ts

@@ -0,0 +1,60 @@
+// The billing gate, with OPENFRAME_ENABLE_STRIPE=true.
+//
+// The flag is deliberately on for this suite. With it off, hasBillingAccess()
+// short-circuits to `true` and buildBillingAccessWhereInput() returns `{}`, so
+// every assertion in this file would pass against a gate that does not exist.
+// See playwright.config.ts.
+//
+// Nothing here clicks a checkout button: with dummy Stripe credentials that
+// would be a real request to Stripe. The assertions stop at the button being
+// offered.
+import { anonTest as test, expect, signInPage } from './fixtures';
+
+test('a user whose trial has ended is pushed to settings and cannot open a project', async ({
+  page,
+  seed,
+}) => {
+  const expired = await seed.expiredUser();
+  const seeded = await seed.version(expired);
+
+  await signInPage(page, expired.email ?? '');
+
+  // The dashboard is not reachable: requireBillingAccessOrRedirect sends the
+  // user to /settings.
+  await page.goto('/dashboard');
+  await expect(page).toHaveURL(/\/settings$/);
+  await expect(page.getByRole('heading', { name: 'Settings', level: 1 })).toBeVisible();
+  await expect(page.getByText('Manage your billing access')).toBeVisible();
+  await expect(page.getByText('Billing access has ended.')).toBeVisible();
+
+  // The trial was consumed, so the offer is an upgrade rather than a new trial.
+  // Offered, not clicked.
+  await expect(page.getByRole('button', { name: 'Upgrade with Stripe' })).toBeEnabled();
+
+  // Their own project is closed to them too: computeProjectAccess() gates on the
+  // workspace owner's billing, and they are that owner.
+  await page.goto(`/projects/${seeded.project.id}`);
+  await expect(page).toHaveURL(/\/settings$/);
+
+  await page.goto(`/projects/${seeded.project.id}/videos/${seeded.videoId}`);
+  await expect(page).toHaveURL(/\/settings$/);
+});
+
+test('a user with an active trial reaches the dashboard and the project', async ({
+  page,
+  seed,
+}) => {
+  // The other half of the same gate: without this, a broken redirect that sent
+  // everyone to /settings would look like a passing test above.
+  const active = await seed.user();
+  const seeded = await seed.version(active);
+
+  await signInPage(page, active.email ?? '');
+
+  await page.goto('/dashboard');
+  await expect(page).toHaveURL(/\/dashboard$/);
+  await expect(page.getByRole('heading', { name: 'Projects', level: 1 })).toBeVisible();
+
+  await page.goto(`/projects/${seeded.project.id}`);
+  await expect(page.getByRole('heading', { name: seeded.project.name, level: 1 })).toBeVisible();
+});