test(api): Infra (health/db/schema/seed/env/migrate) — fill gaps + lifecycle test

Drives all infra src files to 100% (env.ts, db/client.ts, db/ensure-dir.ts,
db/migrate.ts, db/seed.ts, routes/health.ts).

- env.test.ts: dev defaults when unset, overrides when set (PORT coerced),
  CORS_ORIGINS parsing (trim + drop empties) and empty-fallback.
- db.test.ts: runMigrations idempotency; ensureDbDir no-op for non-file URLs
  and bare filenames (branch coverage).
- seed.test.ts: production guard — no dev users seeded when NODE_ENV=production.
- c8-ignore the migrate.ts/seed.ts CLI direct-run blocks (unreachable under vitest).

No lifecycle test (infra domain, per plan). No bugs found — infra code correct;
only coverage gaps. All 112 API tests green; typecheck + oxlint clean.

docs/reference/domain-test-checklist.md

@@ -17,3 +17,26 @@ Target after the sweep: near-100% per domain; remaining uncovered lines annotate
 `/* c8 ignore next -- <reason> */`, not left silent.
 
 <!-- Phase B appends one "## <domain>" section per domain below. -->
+
+## Infra (health/db/schema/seed/env/migrate)
+
+Src covered: `src/routes/health.ts`, `src/db/client.ts`, `src/db/ensure-dir.ts`,
+`src/db/migrate.ts`, `src/db/seed.ts`, `src/env.ts` — all at 100% stmts/branch/funcs/lines.
+(`src/db/schema.ts` is generated and excluded from coverage by config.)
+
+Guaranteed behaviors:
+
+- `GET /health` returns `{ status: 'ok' }`.
+- `env.ts` applies every dev default (`DATABASE_URL`, `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`,
+  `PORT`, `WEB_ORIGINS`) when the vars are unset, and reads each override when set (`PORT`
+  coerced to a number).
+- `env.WEB_ORIGINS` parses `CORS_ORIGINS` into a list, trimming whitespace and dropping empty
+  entries; falls back to the default localhost origins when `CORS_ORIGINS` is empty/unset.
+- `runMigrations()` is idempotent — re-running it against an already-migrated DB does not throw.
+- `ensureDbDir()` is a no-op for non-`file:` URLs and for a bare filename in the current dir.
+- `seed()` seeds the reference activities idempotently and seeds the dev worker + dev admin with
+  the correct roles, idempotently.
+- `seed()` never creates the dev users when `NODE_ENV=production` (reference activities still
+  seeded).
+- The `migrate.ts` / `seed.ts` CLI direct-run blocks are `c8 ignore`d — unreachable under the
+  test runner (exercised only via `tsx src/db/{migrate,seed}.ts`).