perf(test): build baseline DB once via vitest globalSetup (#829)

Each test file's setupTestDb() previously re-ran the full
DatabaseService init path: initSchema (~30 CREATE TABLE IF NOT
EXISTS), 14 idempotent migrate*() methods, a bcrypt hash, and the
admin / settings seed inserts. With 82 files this was a meaningful
slice of the per-fork cold-start cost.

Move the build into a vitest globalSetup that runs once before any
worker boots. The baseline DB lands at a fixed temp path; each
worker's setupTestDb copies it into the per-file data dir, opens the
copy via DatabaseService.getInstance() (re-running the same
idempotent init as a no-op pass), then UPDATEs the seeded local
node's compose_dir to match the per-file COMPOSE_DIR (the baseline
recorded /app/compose because COMPOSE_DIR was unset when the seed
fired in initSchema; without realigning, file-routes tests 400 on
path traversal).

TEST_JWT_SECRET moves from a per-file randomBytes assignment to a
fixed constant in a new testConstants module so the value the
baseline seeds matches the value test files import for direct token
signing. setupTestDb re-exports it for back-compat with the existing
import sites.

A baseline-less measurement on the same machine flakes 30 of 82
files at the no-cap baseline; with this baseline copy, the same
tree drops to 0-3 failures (the residual environmental Windows
flakes) and ~47-52 s wall time.

backend/src/__tests__/helpers/testConstants.ts

@@ -0,0 +1,20 @@
+import os from 'os';
+import path from 'path';
+
+/**
+ * Constants shared between vitestGlobalSetup (which builds the baseline
+ * test DB once) and setupTestDb (which copies the baseline per file).
+ * Kept in their own module so both can import without circular deps.
+ */
+
+export const TEST_USERNAME = 'testadmin';
+export const TEST_PASSWORD = 'testpassword123';
+// Fixed across the suite so JWT signing/verifying lines up between the
+// admin user seeded in the baseline and tests that sign tokens directly.
+// 64 hex chars matches the shape of a real JWT_SECRET produced by
+// crypto.randomBytes(32).toString('hex'); the value itself is not secret.
+export const TEST_JWT_SECRET =
+  '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef';
+
+export const BASELINE_DIR = path.join(os.tmpdir(), 'sencho-test-baseline');
+export const BASELINE_DB_PATH = path.join(BASELINE_DIR, 'sencho.db');