test(api): Infra (health/db/schema/seed/env/migrate) — fill gaps + lifecycle test

Drives all infra src files to 100% (env.ts, db/client.ts, db/ensure-dir.ts,
db/migrate.ts, db/seed.ts, routes/health.ts).

- env.test.ts: dev defaults when unset, overrides when set (PORT coerced),
  CORS_ORIGINS parsing (trim + drop empties) and empty-fallback.
- db.test.ts: runMigrations idempotency; ensureDbDir no-op for non-file URLs
  and bare filenames (branch coverage).
- seed.test.ts: production guard — no dev users seeded when NODE_ENV=production.
- c8-ignore the migrate.ts/seed.ts CLI direct-run blocks (unreachable under vitest).

No lifecycle test (infra domain, per plan). No bugs found — infra code correct;
only coverage gaps. All 112 API tests green; typecheck + oxlint clean.

apps/api/src/db/migrate.ts

@@ -15,6 +15,7 @@ export async function runMigrations(): Promise<void> {
 
 // Allow running directly: `tsx src/db/migrate.ts` (cross-platform — pathToFileURL
 // handles Windows drive-letter/backslash paths, which a raw `file://` prefix does not).
+/* c8 ignore start -- CLI entry point; unreachable when imported by the test runner */
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   runMigrations()
     .then(() => {
@@ -26,3 +27,4 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       process.exit(1);
     });
 }
+/* c8 ignore stop */

apps/api/src/db/seed.ts

@@ -67,6 +67,7 @@ export async function seed(): Promise<void> {
 
 // Allow running directly: `tsx src/db/seed.ts` (cross-platform — pathToFileURL
 // handles Windows drive-letter/backslash paths, which a raw `file://` prefix does not).
+/* c8 ignore start -- CLI entry point; unreachable when imported by the test runner */
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   seed()
     .then(() => {
@@ -78,3 +79,4 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       process.exit(1);
     });
 }
+/* c8 ignore stop */