Add unit and integration test suites

- Shared: link building, feed ordering, input schemas, API client
- API unit: track matching, private-address blocking, token crypto,
  plan expiry, provider response parsing
- API integration against Postgres and Redis: auth, follows and pins,
  now-playing state, webhooks, OAuth return URLs, realtime, rate limits
- Tests use a dedicated *_test database and Redis DB, and refuse to wipe
  anything else; fetch is stubbed so they never hit the network
- Pin Node to 22.13+ (.nvmrc), which Vite's native bindings require

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

packages/shared/src/dto.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+import { sortFeed, type FeedItemDTO } from './dto';
+
+function item(username: string, opts: { pinnedAt?: string; isPlaying?: boolean; updatedAt?: string }): FeedItemDTO {
+  return {
+    user: { id: username, username, displayName: null, avatarUrl: null },
+    track: { id: 't', title: 't', artist: 'a', album: null, artworkUrl: null, durationMs: null, isrc: null, links: {} },
+    isPlaying: opts.isPlaying ?? false,
+    source: 'spotify',
+    progressMs: null,
+    updatedAt: opts.updatedAt ?? '2026-01-01T00:00:00.000Z',
+    pinnedAt: opts.pinnedAt ?? null,
+  };
+}
+
+const names = (items: FeedItemDTO[]) => items.map((i) => i.user.username);
+
+describe('sortFeed', () => {
+  it('puts pinned friends first, in the order they were pinned', () => {
+    const feed = sortFeed([
+      item('live', { isPlaying: true }),
+      item('pinnedSecond', { pinnedAt: '2026-01-02T00:00:00.000Z' }),
+      item('pinnedFirst', { pinnedAt: '2026-01-01T00:00:00.000Z' }),
+    ]);
+    expect(names(feed)).toEqual(['pinnedFirst', 'pinnedSecond', 'live']);
+  });
+
+  it('then live listeners, then most recently updated', () => {
+    const feed = sortFeed([
+      item('old', { updatedAt: '2026-01-01T00:00:00.000Z' }),
+      item('recent', { updatedAt: '2026-01-03T00:00:00.000Z' }),
+      item('live', { isPlaying: true, updatedAt: '2025-12-01T00:00:00.000Z' }),
+    ]);
+    expect(names(feed)).toEqual(['live', 'recent', 'old']);
+  });
+
+  it('does not mutate its input', () => {
+    const input = [item('b', {}), item('a', { isPlaying: true })];
+    sortFeed(input);
+    expect(names(input)).toEqual(['b', 'a']);
+  });
+});