Testing: add DB integration tests against a real Postgres (fresh migrated DB per test)

[rubenhensen]

Problem

Test coverage is Vitest (unit, node env) + Playwright (e2e). The server-side database logic — services, resolveSession / createSession, API-key hashing/lookup, change-request approval, audit logging — isn't exercised against a real Postgres. Unit tests can't catch SQL / constraint / migration mismatches, and e2e is too coarse to pin them down.

Why it matters

• Schema/query regressions slip through until manual testing or production.
• Idempotency, unique-constraint, and transaction behavior are only asserted (if at all) end-to-end.

Proposal

• Add an integration test harness that provisions a throwaway, freshly-migrated Postgres per test (spin a container, or use the CI postgres service with a unique database/schema per test), then runs the real store/service code against it.
• Model it on the sibling Yivi Business Wallet project's testdb.Fresh(t) pattern: an isolated migrated DB per test, with only the external IdP (IRMA) faked.
• Wire it into CI alongside the existing test job.

Acceptance criteria

• A helper that returns a migrated, isolated DB for a test and tears it down afterwards.
• Integration coverage for sessions, API keys, and change-request approval.
• Runs in CI against the Postgres service.