perf(test): build baseline DB once via vitest globalSetup (#829)

Each test file's setupTestDb() previously re-ran the full
DatabaseService init path: initSchema (~30 CREATE TABLE IF NOT
EXISTS), 14 idempotent migrate*() methods, a bcrypt hash, and the
admin / settings seed inserts. With 82 files this was a meaningful
slice of the per-fork cold-start cost.

Move the build into a vitest globalSetup that runs once before any
worker boots. The baseline DB lands at a fixed temp path; each
worker's setupTestDb copies it into the per-file data dir, opens the
copy via DatabaseService.getInstance() (re-running the same
idempotent init as a no-op pass), then UPDATEs the seeded local
node's compose_dir to match the per-file COMPOSE_DIR (the baseline
recorded /app/compose because COMPOSE_DIR was unset when the seed
fired in initSchema; without realigning, file-routes tests 400 on
path traversal).

TEST_JWT_SECRET moves from a per-file randomBytes assignment to a
fixed constant in a new testConstants module so the value the
baseline seeds matches the value test files import for direct token
signing. setupTestDb re-exports it for back-compat with the existing
import sites.

A baseline-less measurement on the same machine flakes 30 of 82
files at the no-cap baseline; with this baseline copy, the same
tree drops to 0-3 failures (the residual environmental Windows
flakes) and ~47-52 s wall time.

backend/src/__tests__/helpers/setupTestDb.ts

@@ -4,16 +4,23 @@
  *
  * Call this at the top of every test file *before* importing the app,
  * because DatabaseService initialises its path on first getInstance() call.
+ *
+ * The baseline DB (schema + migrations + admin seed) is built once by
+ * vitest globalSetup; this helper just copies it into the per-test temp
+ * directory so each file pays a file-copy cost instead of a full
+ * schema-init + bcrypt.hash + seed-insert.
  */
 import os from 'os';
 import path from 'path';
 import fs from 'fs';
-import bcrypt from 'bcrypt';
-import crypto from 'crypto';
+import {
+  TEST_USERNAME,
+  TEST_PASSWORD,
+  TEST_JWT_SECRET,
+  BASELINE_DB_PATH,
+} from './testConstants';
 
-export const TEST_USERNAME = 'testadmin';
-export const TEST_PASSWORD = 'testpassword123';
-export let TEST_JWT_SECRET = '';
+export { TEST_USERNAME, TEST_PASSWORD, TEST_JWT_SECRET };
 
 export async function setupTestDb(): Promise<string> {
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sencho-test-'));
@@ -23,19 +30,29 @@ export async function setupTestDb(): Promise<string> {
   fs.mkdirSync(composeDir, { recursive: true });
   process.env.COMPOSE_DIR = composeDir;
 
-  // Initialise the DB (singleton will use DATA_DIR we just set)
+  if (!fs.existsSync(BASELINE_DB_PATH)) {
+    throw new Error(
+      `Baseline test DB not found at ${BASELINE_DB_PATH}. Vitest globalSetup ` +
+      `(backend/src/__tests__/helpers/vitestGlobalSetup.ts) is responsible for ` +
+      `building it; check that vitest.config.ts still wires globalSetup.`,
+    );
+  }
+  fs.copyFileSync(BASELINE_DB_PATH, path.join(tmpDir, 'sencho.db'));
+
+  // Initialise the DB singleton against the copied baseline. The constructor
+  // re-runs initSchema() (CREATE TABLE IF NOT EXISTS no-ops) and every
+  // migrate*() (idempotent per CLAUDE.md), so opening an already-migrated
+  // copy is fast.
   const { DatabaseService } = await import('../../services/DatabaseService');
   const db = DatabaseService.getInstance();
 
-  // Seed admin credentials
-  const passwordHash = await bcrypt.hash(TEST_PASSWORD, 1); // cost=1 for speed in tests
-  TEST_JWT_SECRET = crypto.randomBytes(32).toString('hex');
-  db.updateGlobalSetting('auth_username', TEST_USERNAME);
-  db.updateGlobalSetting('auth_password_hash', passwordHash);
-  db.updateGlobalSetting('auth_jwt_secret', TEST_JWT_SECRET);
-
-  // Also seed the users table (RBAC login reads from here)
-  db.addUser({ username: TEST_USERNAME, password_hash: passwordHash, role: 'admin' });
+  // The baseline's local node row was seeded with whatever COMPOSE_DIR was
+  // at globalSetup time (undefined, so fell back to /app/compose). Each
+  // test file resolves stack paths against process.env.COMPOSE_DIR via
+  // FileSystemService; routes that look up the node's stored compose_dir
+  // need it to match the per-file temp dir, otherwise they 400 on
+  // path-traversal or 404 on missing files. Realign here.
+  db.getDb().prepare('UPDATE nodes SET compose_dir = ? WHERE is_default = 1').run(composeDir);
 
   return tmpDir;
 }