fix(test): keep the suites off a developer's real database

bun loads a plain `.env` into process.env before anything runs, and
tests/helpers/env.ts read that as a deliberate export, so it beat `.env.test`
outright. `scripts/test.sh api` therefore pointed the api suites at whatever
deployment `.env` describes: `prisma db push --accept-data-loss` for the
schema, then a truncate of every table between tests. The e2e half was worse,
because playwright.config.ts built and started the app with that DATABASE_URL
and those R2 credentials, then wrote fixtures into it. CI never saw any of
this: a runner has no `.env`.

Three changes, in order of what each one catches:

- helpers/dev-env.ts drops the values bun copied out of a development env file,
  leaving `.env.test` to fill them. Only values that match the file
  character-for-character go, so a real export still wins and the per-suite
  databases of a parallel api run keep working.
- helpers/test-database.ts refuses a DATABASE_URL whose database name is not
  marked as a test one, at the single point every path into the setup passes
  through. This is the backstop, not the fix.
- playwright.config.ts blanks the variables a development env file defines and
  the config does not. Dropping them from process.env is not enough there:
  `next build` and `next start` run @next/env themselves and read the files
  again. That is also why a local e2e run could not build at all (a set
  DISABLE_RATE_LIMIT throws in lib/rate-limit.ts under NODE_ENV=production) and
  why auth.spec.ts failed on a machine with SMTP configured.

`scripts/test.sh` now creates `.env.test` from the committed example instead of
asking for a one-line copy, so the guard above is something nobody has to meet.

.env.test.example

@@ -1,11 +1,14 @@
-# Environment for the `api` Vitest project. Copy to `.env.test` (gitignored):
-#   cp .env.test.example .env.test
+# Environment for the `api` Vitest project. `scripts/test.sh` copies this to
+# `.env.test` (gitignored) on the first api or e2e run, so there is usually
+# nothing to do by hand.
 #
 # `tests/setup/db-global.ts` and `tests/setup/api.ts` both load this file (via
 # `tests/helpers/env.ts`) before anything imports `@/lib/db`, which reads
 # DATABASE_URL once at module load and memoizes the pool. An already-exported
 # variable always wins over the file, so CI can override DATABASE_URL without
-# editing anything.
+# editing anything. What bun autoloaded from a development `.env` does not count
+# as exported and is dropped first, or that file would quietly win here and
+# point the suites at a real deployment.
 
 # ---------------------------------------------------------------------------
 # DATABASE