test: testing overhaul -- CI e2e gates, parallel suites, generated matrices, mutation testing (#215)

Closes the "e2e never runs in CI" hole. Adds per-PR e2e smoke gate,
nightly full-suite workflows, parallel vitest forks (per-fork DBs),
Playwright parallel/serial/visual projects against production builds,
metadata-generated test suites (drift guards, hostile inputs, format
matrix, pairwise settings, property-based fuzz), Stryker mutation
testing, Schemathesis API fuzz, coverage ratchet, and fixes for three
session-poisoning bugs that caused 200+ serial-bucket failures.

Bug fix included: favicon/split/bulk-rename could hang clients forever
when ZIP streaming failed after reply.hijack().

apps/api/src/routes/settings.ts

@@ -10,6 +10,7 @@ import { eq } from "drizzle-orm";
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 import { db, schema } from "../db/index.js";
+import { auditLog } from "../lib/audit.js";
 import { requirePermission } from "../permissions.js";
 import { requireAuth } from "../plugins/auth.js";
 
@@ -86,6 +87,14 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       }
     }
 
+    if (entries.length > 0) {
+      auditLog(request.log, "SETTINGS_UPDATED", {
+        adminId: admin.id,
+        username: admin.username,
+        keys: entries.map((e) => e.key),
+      });
+    }
+
     return reply.send({ ok: true, updatedCount: entries.length });
   });