test: reorganize flat test files into purpose-based subdirectories (phase 6)

Group 245 flat integration tests and 25 loose unit tests into
discoverable subdirectories per spec section 6:

  integration/tools/{image,video,audio,document,data}/  (156 files)
  integration/platform/                                  (64 files)
  integration/generated/                                 (14 files)
  integration/security/                                  (10 files)

  unit/security/     (8 files, new subdir)
  unit/api/          (7 files moved in)
  unit/web/          (3 files moved in)
  unit/shared/       (6 files moved in)
  unit/image-engine/ (1 file moved in)

All moves via git mv (history preserved). Relative imports repaired
for both depth levels (platform/generated/security = +1, tools/ = +2):
static from-imports, dynamic import() calls, vi.mock() paths,
import.meta.dirname joins, and __dirname joins.

Vitest discovery unchanged (no test.include in config, recursive glob
matches subdirs, shard-by-hash unaffected). test-server.ts and
tool-route-drift.test.ts stay at integration root. fixtures/ untouched.

Parity gate: 13189 passing test names before = 13189 after (0 dropped).

tests/integration/tools/audio/transcribe-audio.test.ts

@@ -0,0 +1,190 @@
+/**
+ * Integration tests for the transcribe-audio tool (/api/v1/tools/transcribe-audio).
+ *
+ * The transcription bundle (faster-whisper) is not installed locally, so the
+ * 501 gate is always hit. Validation paths (bad settings) are tested after
+ * the 501 check fires first. The bundle-gated happy path lives in a skipped
+ * describe for in-container-after-install runs.
+ */
+
+import { readFileSync } from "node:fs";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { fixtureDir, fixtures } from "../../../fixtures/index.js";
+import {
+  buildTestApp,
+  createMultipartPayload,
+  loginAsAdmin,
+  type TestApp,
+} from "../../test-server.js";
+
+const MEDIA = fixtureDir.media;
+const MP3 = readFileSync(fixtures.audio.tiny("mp3"));
+
+let testApp: TestApp;
+let app: TestApp["app"];
+let adminToken: string;
+
+beforeAll(async () => {
+  testApp = await buildTestApp();
+  app = testApp.app;
+  adminToken = await loginAsAdmin(app);
+}, 30_000);
+
+afterAll(async () => {
+  await testApp.cleanup();
+}, 10_000);
+
+describe("transcribe-audio", () => {
+  // -- 501 gate (always fires locally: bundle never installed) --
+
+  it("returns 501 FEATURE_NOT_INSTALLED when bundle is absent", async () => {
+    const { body, contentType } = createMultipartPayload([
+      {
+        name: "file",
+        filename: "tiny.mp3",
+        contentType: "audio/mpeg",
+        content: MP3,
+      },
+      { name: "settings", content: JSON.stringify({}) },
+    ]);
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/v1/tools/transcribe-audio",
+      headers: {
+        authorization: `Bearer ${adminToken}`,
+        "content-type": contentType,
+      },
+      body,
+    });
+
+    expect(res.statusCode).toBe(501);
+    const json = JSON.parse(res.body);
+    expect(json.code).toBe("FEATURE_NOT_INSTALLED");
+    expect(json.feature).toBe("transcription");
+    expect(json.featureName).toBe("Transcription");
+    expect(json.estimatedSize).toBeDefined();
+  });
+
+  // -- Validation (501 fires before settings parse, so these also 501) --
+
+  it("returns 501 even with invalid outputFormat (gate fires first)", async () => {
+    const { body, contentType } = createMultipartPayload([
+      {
+        name: "file",
+        filename: "tiny.mp3",
+        contentType: "audio/mpeg",
+        content: MP3,
+      },
+      {
+        name: "settings",
+        content: JSON.stringify({ outputFormat: "doc" }),
+      },
+    ]);
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/v1/tools/transcribe-audio",
+      headers: {
+        authorization: `Bearer ${adminToken}`,
+        "content-type": contentType,
+      },
+      body,
+    });
+
+    // 501 because the bundle gate fires before settings validation
+    expect(res.statusCode).toBe(501);
+    const json = JSON.parse(res.body);
+    expect(json.code).toBe("FEATURE_NOT_INSTALLED");
+  });
+
+  it("rejects unauthenticated requests (401)", async () => {
+    const { body, contentType } = createMultipartPayload([
+      {
+        name: "file",
+        filename: "tiny.mp3",
+        contentType: "audio/mpeg",
+        content: MP3,
+      },
+      { name: "settings", content: JSON.stringify({}) },
+    ]);
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/v1/tools/transcribe-audio",
+      headers: { "content-type": contentType },
+      body,
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  // -- Bundle-gated happy path (skipped locally, runs after bundle install) --
+
+  // The transcription bundle is ~600 MB and only available in Docker.
+  // These tests run when the bundle is installed (e.g., during Task 7 smoke).
+  // Locally they always skip.
+  describe.skip("with transcription bundle installed", () => {
+    it("transcribes audio to txt (202 + async)", async () => {
+      const { body, contentType } = createMultipartPayload([
+        {
+          name: "file",
+          filename: "tiny.mp3",
+          contentType: "audio/mpeg",
+          content: MP3,
+        },
+        {
+          name: "settings",
+          content: JSON.stringify({ outputFormat: "txt" }),
+        },
+      ]);
+
+      const res = await app.inject({
+        method: "POST",
+        url: "/api/v1/tools/transcribe-audio",
+        headers: {
+          authorization: `Bearer ${adminToken}`,
+          "content-type": contentType,
+        },
+        body,
+      });
+
+      expect(res.statusCode).toBe(202);
+      const json = JSON.parse(res.body);
+      expect(json.jobId).toBeDefined();
+      expect(json.async).toBe(true);
+    }, 120_000);
+
+    it("transcribes audio to srt with correct structure", async () => {
+      const { body, contentType } = createMultipartPayload([
+        {
+          name: "file",
+          filename: "tiny.mp3",
+          contentType: "audio/mpeg",
+          content: MP3,
+        },
+        {
+          name: "settings",
+          content: JSON.stringify({ outputFormat: "srt" }),
+        },
+      ]);
+
+      const res = await app.inject({
+        method: "POST",
+        url: "/api/v1/tools/transcribe-audio",
+        headers: {
+          authorization: `Bearer ${adminToken}`,
+          "content-type": contentType,
+        },
+        body,
+      });
+
+      expect(res.statusCode).toBe(202);
+      const json = JSON.parse(res.body);
+      expect(json.jobId).toBeDefined();
+      // Full SRT structure validation happens after polling completes.
+      // The sine tone fixture may produce empty or noise text;
+      // we assert mechanics (counter line "1", arrow timestamp), not words.
+    }, 120_000);
+  });
+});