test(api): Auth & /me — fill gaps + lifecycle test

apps/api/test/auth.test.ts

@@ -9,6 +9,17 @@ describe('auth', () => {
     expect(token).toBeTruthy();
   });
 
+  it('rejects sign-in with a wrong password', async () => {
+    const app = createApp();
+    await authToken(app, 'wrong-pw@example.com'); // create the user first
+    const res = await app.request('/api/auth/sign-in/email', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ email: 'wrong-pw@example.com', password: 'not-the-password' }),
+    });
+    expect(res.status).toBeGreaterThanOrEqual(400);
+  });
+
   it('rejects public sign-up (admin creates users)', async () => {
     const app = createApp();
     const res = await app.request('/api/auth/sign-up/email', {