test: add unit, API, component and end-to-end test suites

The repo had no automated tests. Every change was verified by hand.

Adds four layers, 2023 tests in total, runnable with one command:

- 1191 unit tests over the pure logic in lib/, including the full
  computeProjectAccess permission matrix and the billing gate
- 167 component and hook tests in jsdom, covering the hooks that hold
  real logic rather than presentational wrappers
- 647 API integration tests against a real Postgres, with only auth()
  mocked, including a data-driven sweep asserting that none of the 60
  route modules answers 2xx to an unauthenticated caller
- 18 Playwright specs driving a real browser against a real build

Infrastructure: vitest.config.ts with three projects, a disposable
Postgres and MinIO in docker-compose.test.yml, factories and helpers
under tests/, scripts/test.sh as the single entry point, a pre-push
hook running bun run verify, and CI split into check, test and e2e jobs.

The test database is built with prisma db push plus a replay of the
hand-written SQL, because prisma migrate deploy cannot build this schema
from empty: the migration history has no captured baseline. This mirrors
what scripts/docker-db-bootstrap.ts already does in production, and
tests/setup/db-global.ts carries a drift guard so a new migration fails
the run until someone reviews it.

Production code is unchanged apart from one pure-function extraction out
of use-video-player.ts, which was too large to test in jsdom.

Several tests pin behaviour that looks wrong, each marked KNOWN BUG in
place. TESTING.md section 12 records where the plan turned out to be
wrong, and AGENTS.md now states which layer a change needs a test in.

tests/helpers/env.ts

@@ -0,0 +1,86 @@
+// Loads `.env.test` into `process.env`.
+//
+// This module exists so it can be the *first* import of both
+// `tests/setup/api.ts` and `tests/setup/db-global.ts`. ESM evaluates imports in
+// source order, so putting `import '../helpers/env';` above everything else
+// guarantees DATABASE_URL is set before `@/lib/db` is reached: that module reads
+// `process.env.DATABASE_URL` once at import time and memoizes the pg pool on
+// `globalThis`, so a late load would silently point every test at the wrong
+// database (or at no database at all).
+//
+// It must therefore never import from `@/lib/*`.
+//
+// Contract: an already-exported variable always wins. `.env.test` fills the
+// gaps. That is what lets CI export DATABASE_URL for a service container
+// without needing a `.env.test` file at all.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { config as loadDotenv } from 'dotenv';
+
+/**
+ * Walks up from the working directory until it finds the checkout.
+ *
+ * This deliberately avoids `import.meta.url`, which would be the obvious way to
+ * resolve a path relative to this file: Playwright transpiles TypeScript to
+ * CommonJS unless package.json declares `"type": "module"`, and in CommonJS
+ * `import.meta` is a *syntax* error, so the e2e suite could not import this
+ * module at all. `__dirname` has the mirror-image problem under Vitest's ESM.
+ *
+ * The marker is prisma/schema.prisma as well as package.json, so a stray
+ * package.json inside node_modules cannot be mistaken for the checkout.
+ */
+function findRepoRoot(): string {
+  let current = path.resolve(process.cwd());
+
+  for (;;) {
+    if (
+      fs.existsSync(path.join(current, 'package.json')) &&
+      fs.existsSync(path.join(current, 'prisma', 'schema.prisma'))
+    ) {
+      return current;
+    }
+
+    const parent = path.dirname(current);
+    if (parent === current) {
+      throw new Error(
+        `Could not locate the OpenFrame checkout from ${process.cwd()}: no ancestor ` +
+          'directory holds both package.json and prisma/schema.prisma. Run the test ' +
+          'suites from the repository root.'
+      );
+    }
+    current = parent;
+  }
+}
+
+export const REPO_ROOT = findRepoRoot();
+
+export const TEST_ENV_PATH = path.join(REPO_ROOT, '.env.test');
+
+let loaded = false;
+
+export function loadTestEnv(): void {
+  if (loaded) return;
+  loaded = true;
+
+  if (fs.existsSync(TEST_ENV_PATH)) {
+    loadDotenv({ path: TEST_ENV_PATH, quiet: true });
+  }
+
+  if (!process.env.DATABASE_URL) {
+    throw new Error(
+      'DATABASE_URL is not set for the api test project. Either create .env.test ' +
+        '(cp .env.test.example .env.test) or export DATABASE_URL before running ' +
+        'bun run test:api.'
+    );
+  }
+
+  // Vitest sets this already, but db-global.ts also spawns the Prisma CLI and
+  // lib/rate-limit.ts throws when DISABLE_RATE_LIMIT is set in production.
+  // @types/node declares NODE_ENV as read-only, hence the cast.
+  if (!process.env.NODE_ENV) {
+    (process.env as Record<string, string | undefined>).NODE_ENV = 'test';
+  }
+}
+
+loadTestEnv();