Add unit and integration test suites

- Shared: link building, feed ordering, input schemas, API client
- API unit: track matching, private-address blocking, token crypto,
  plan expiry, provider response parsing
- API integration against Postgres and Redis: auth, follows and pins,
  now-playing state, webhooks, OAuth return URLs, realtime, rate limits
- Tests use a dedicated *_test database and Redis DB, and refuse to wipe
  anything else; fetch is stubbed so they never hit the network
- Pin Node to 22.13+ (.nvmrc), which Vite's native bindings require

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/vitest.config.ts

@@ -0,0 +1,41 @@
+import { defineConfig } from 'vitest/config';
+
+/**
+ * Tests run against a dedicated Postgres database and Redis DB index, never
+ * the dev ones (test/helpers.ts refuses to wipe anything else). Override with
+ * TEST_DATABASE_URL / TEST_REDIS_URL, e.g. in CI.
+ */
+const testEnv = {
+  NODE_ENV: 'test',
+  DATABASE_URL: process.env.TEST_DATABASE_URL ?? 'postgres://musicshare:musicshare@localhost:5447/musicshare_test',
+  REDIS_URL: process.env.TEST_REDIS_URL ?? 'redis://localhost:6380/1',
+  TOKEN_ENCRYPTION_KEY: Buffer.alloc(32, 7).toString('base64'),
+  WEB_URL: 'http://web.test',
+  API_PUBLIC_URL: 'https://api.test',
+  ALLOW_PRIVATE_SERVER_URLS: 'false',
+  LASTFM_API_KEY: 'test-lastfm-key',
+  SPOTIFY_CLIENT_ID: '',
+  SPOTIFY_CLIENT_SECRET: '',
+  ODESLI_API_KEY: '',
+};
+
+export default defineConfig({
+  test: {
+    env: testEnv,
+    projects: [
+      {
+        test: { name: 'unit', include: ['src/**/*.test.ts'] },
+      },
+      {
+        test: {
+          name: 'integration',
+          include: ['test/**/*.test.ts'],
+          globalSetup: ['test/global-setup.ts'],
+          // one shared database: run files one at a time
+          fileParallelism: false,
+          hookTimeout: 30_000,
+        },
+      },
+    ],
+  },
+});