Add comment unit tests and Cypress API tests

[devin-ai-integration]

Summary

Adds comprehensive test coverage for the comments feature across two independent workstreams:

Workstream A — Unit tests (src/__tests__/comments.test.ts):

• Test createComments (plural) with notification side effects: verifies that calling createComments with a third-party user (not sender/receiver) creates the comment and generates notifications for both the transaction's sender and receiver
• Comment object shape assertions: validates the returned comment has all expected Comment interface properties (id, uuid, content, userId, transactionId, createdAt, modifiedAt)
• Test getCommentsByTransactionId returns an empty array for a transaction with no comments

Workstream B — Cypress API tests (cypress/tests/api/api-comments.spec.ts):

• Unauthenticated request tests (401): GET and POST without login return 401
• Invalid transactionId validation (422) on GET: non-shortid 1234 triggers validation error
• Missing content body validation (422) on POST: empty body triggers validation error
• Invalid transactionId validation (422) on POST: non-shortid triggers validation error
• Response body shape validation on GET: asserts comment objects have all expected properties
• POST persistence verification: follow-up GET confirms the created comment was persisted

Review & Testing Checklist for Human

• Verify the unit tests pass locally: npx vitest run src/__tests__/comments.test.ts
• Verify the Cypress API tests pass locally: npx cypress run --spec cypress/tests/api/api-comments.spec.ts (requires app running)
• Confirm the unauthenticated tests (401) correctly clear cookies before making requests — cy.clearCookies() runs after the beforeEach login

Notes

• All 4 unit tests pass locally via vitest
• Cypress API tests require the app server to be running — CI will validate these
• The createComments test exercises the branch at backend/database.ts:675 where userId !== senderId || userId !== receiverId

Link to Devin session: https://app.devin.ai/sessions/042dcfa0177c41e5bcda348450583fed
Requested by: @scottyandrade99

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[staging-devin-ai-integration]

Devin Review

Status	Commit
⚪ Not started	—

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.