fix(test): keep the suites off a developer's real database

bun loads a plain `.env` into process.env before anything runs, and
tests/helpers/env.ts read that as a deliberate export, so it beat `.env.test`
outright. `scripts/test.sh api` therefore pointed the api suites at whatever
deployment `.env` describes: `prisma db push --accept-data-loss` for the
schema, then a truncate of every table between tests. The e2e half was worse,
because playwright.config.ts built and started the app with that DATABASE_URL
and those R2 credentials, then wrote fixtures into it. CI never saw any of
this: a runner has no `.env`.

Three changes, in order of what each one catches:

- helpers/dev-env.ts drops the values bun copied out of a development env file,
  leaving `.env.test` to fill them. Only values that match the file
  character-for-character go, so a real export still wins and the per-suite
  databases of a parallel api run keep working.
- helpers/test-database.ts refuses a DATABASE_URL whose database name is not
  marked as a test one, at the single point every path into the setup passes
  through. This is the backstop, not the fix.
- playwright.config.ts blanks the variables a development env file defines and
  the config does not. Dropping them from process.env is not enough there:
  `next build` and `next start` run @next/env themselves and read the files
  again. That is also why a local e2e run could not build at all (a set
  DISABLE_RATE_LIMIT throws in lib/rate-limit.ts under NODE_ENV=production) and
  why auth.spec.ts failed on a machine with SMTP configured.

`scripts/test.sh` now creates `.env.test` from the committed example instead of
asking for a one-line copy, so the guard above is something nobody has to meet.

scripts/test.sh

@@ -142,14 +142,27 @@ require_compose_file() {
     'and e2e suites cannot run until that lands.'
 }
 
-require_env_test() {
+# Creates .env.test rather than telling the reader to copy it.
+#
+# The file is gitignored but holds nothing secret: it is the throwaway postgres
+# and minio credentials out of docker-compose.test.yml, written for exactly the
+# containers this script starts. There is no decision for anyone to make.
+#
+# It is also a safety measure. bun loads a plain `.env` into the environment on
+# its own, so with no .env.test the suites inherit whatever DATABASE_URL a
+# developer keeps in .env, which is usually a real deployment. The api setup
+# builds its schema with `prisma db push --accept-data-loss` and truncates every
+# table between tests. tests/helpers/test-database.ts refuses to run against a
+# database that is not named as a test one, and this keeps that refusal from
+# being something anybody has to see.
+ensure_env_test() {
   [ -f "$env_test" ] && return 0
-  if [ -f "$env_test_example" ]; then
-    die "$env_test not found." \
-      'Create it once with: cp .env.test.example .env.test'
+  if [ ! -f "$env_test_example" ]; then
+    die "Neither $env_test nor $env_test_example exists." \
+      'Both ship with Phase 2 of TESTING.md (section 5).'
   fi
-  die "Neither $env_test nor $env_test_example exists." \
-    'Both ship with Phase 2 of TESTING.md (section 5).'
+  cp "$env_test_example" "$env_test"
+  say 'created .env.test from .env.test.example'
 }
 
 require_playwright_config() {
@@ -257,7 +270,7 @@ run_mutation() {
 run_api() {
   say 'api suites'
   require_compose_file
-  require_env_test
+  ensure_env_test
   start_test_db
   run_in_bun_image "$network" "$install_step && bun run test:api"
 }
@@ -266,7 +279,7 @@ run_e2e() {
   say 'end-to-end specs'
   require_compose_file
   require_playwright_config
-  require_env_test
+  ensure_env_test
   start_test_db
   start_test_storage
   # The official Playwright image carries node and the browsers but not bun.