fix(test): mock db/index.js in unit tests that import API modules

Five unit tests crashed because they imported modules that transitively
reached db/index.ts, which eagerly calls `new Database()` at module load
time. Added vi.mock for db/index.js matching the pattern used by 16
other passing API unit tests.

Moved cleanup.test.ts to tests/integration/ since it uses a real SQLite
database, runs migrations, and inserts rows.

tests/unit/api/auth-functions.test.ts

@@ -1,4 +1,10 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../../../apps/api/src/db/index.js", () => ({
+  db: {},
+  schema: {},
+}));
+
 import {
   computeKeyPrefix,
   hashPassword,

tests/unit/api/effective-permissions.test.ts

@@ -8,7 +8,13 @@
 import type { Permission, Role } from "@snapotter/shared";
 import { describe, expect, it, vi } from "vitest";
 
-// Mock the auth plugin to avoid transitively opening a SQLite connection
+vi.mock("../../../apps/api/src/db/index.js", () => ({
+  db: {
+    select: () => ({ from: () => ({ where: () => ({ get: () => null }) }) }),
+  },
+  schema: { roles: {}, settings: {} },
+}));
+
 vi.mock("../../../apps/api/src/plugins/auth.js", () => ({
   getAuthUser: () => null,
 }));

tests/unit/api/permissions.test.ts

@@ -8,9 +8,13 @@
 import type { Role } from "@snapotter/shared";
 import { describe, expect, it, vi } from "vitest";
 
-// Mock the auth plugin to avoid transitively opening a SQLite connection
-// (permissions.ts -> auth.ts -> db/index.ts), which causes lock contention
-// when running in parallel with other DB-using test files like cleanup.test.ts.
+vi.mock("../../../apps/api/src/db/index.js", () => ({
+  db: {
+    select: () => ({ from: () => ({ where: () => ({ get: () => null }) }) }),
+  },
+  schema: { roles: {}, settings: {} },
+}));
+
 vi.mock("../../../apps/api/src/plugins/auth.js", () => ({
   getAuthUser: () => null,
 }));

tests/unit/api/rbac-enforcement.test.ts

@@ -1,4 +1,16 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../../../apps/api/src/db/index.js", () => ({
+  db: {
+    select: () => ({ from: () => ({ where: () => ({ get: () => null }) }) }),
+  },
+  schema: { roles: {}, settings: {} },
+}));
+
+vi.mock("../../../apps/api/src/plugins/auth.js", () => ({
+  getAuthUser: () => null,
+}));
+
 import { getPermissions, hasPermission } from "../../../apps/api/src/permissions.js";
 
 describe("role permissions", () => {

tests/unit/security-auth-hardening.test.ts

@@ -6,7 +6,13 @@
  * - Auth Zod schemas enforce max length on username/password fields
  * - New storage env vars have correct defaults
  */
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../../apps/api/src/db/index.js", () => ({
+  db: {},
+  schema: {},
+}));
+
 import { loadEnv } from "../../apps/api/src/lib/env.js";
 import {
   changePasswordSchema,