test(api): Activities — fill gaps + lifecycle test

docs/reference/domain-test-checklist.md

@@ -63,3 +63,30 @@ Guaranteed behaviors:
 - CORS: the allowed SPA origins (worker 5173, admin 5174) are echoed on the
   `access-control-allow-origin` header, OPTIONS preflight is answered with the allowed methods,
   and `set-auth-token` is exposed so the SPA can read the bearer on sign-in.
+
+## Activities
+
+Src covered: `src/routes/activities.ts` — 100% stmts/branch/funcs/lines. The one unreachable
+branch (`row.sortOrder ?? 0` in `toActivity`; `sort_order` is `NOT NULL DEFAULT 0`) is
+`c8 ignore`d with a reason, not left silent.
+
+Guaranteed behaviors:
+
+- `GET /api/activities` requires a session (401 without a token); any authenticated user —
+  worker or admin — may read.
+- The list is ordered by `sort_order` then `name`, and `?insole_type=<type>` filters to
+  activities whose `insole_types` include that type.
+- `POST`/`PUT`/`DELETE`/`PUT /reorder` are admin-only: 401 without a token, 403 for a worker.
+- Create validates a non-empty (trimmed) `name` (400 otherwise) and defaults `insole_types` to
+  all three (`Kurk`, `Berk`, `3D`) when omitted.
+- Create appends the new activity with a `sort_order` one higher than the current maximum.
+- `insole_types` round-trips through create/list as the exact stored subset.
+- Update (`PUT /:id`) 404s for a non-numeric or unknown id, 400s on an invalid body, and returns
+  the updated activity otherwise.
+- Delete (`DELETE /:id`) 404s for a non-numeric id, removes the activity **and** its work-session
+  rows (no FK cascade), and returns `{ success: true }`.
+- Reorder (`PUT /reorder`) sets `sort_order` from the `ids` array position; it 400s on an empty
+  array (zod `min(1)`) and when the ids are not exactly the full known set (wrong count or an
+  unknown id).
+- Lifecycle: an admin creates three activities → reorders them → a worker's GET reflects the new
+  order → the admin deletes one → it is gone from the list.