test(api): Auth & /me — fill gaps + lifecycle test

docs/reference/domain-test-checklist.md

@@ -40,3 +40,26 @@ Guaranteed behaviors:
   seeded).
 - The `migrate.ts` / `seed.ts` CLI direct-run blocks are `c8 ignore`d — unreachable under the
   test runner (exercised only via `tsx src/db/{migrate,seed}.ts`).
+
+## Auth & /me
+
+Src covered: `src/auth.ts`, `src/routes/me.ts`, `src/lib/require-user.ts`, and the CORS
+middleware in `src/app.ts` — all at 100% stmts/branch/funcs/lines.
+
+Guaranteed behaviors:
+
+- Sign-in with valid credentials returns a bearer token (`set-auth-token` header); sign-in with
+  a wrong password fails (status ≥ 400).
+- Public sign-up is rejected (`disableSignUp` — admin creates users).
+- `GET /api/me` returns 401 without a token, and `{ user: { id, email, name, role } }` with a
+  valid bearer; role reflects the user (`worker` / `admin`).
+- `GET /api/me` falls back to role `'worker'` when the session user has no role set.
+- `getSessionUser` maps `id`, `role`, and `banned` from the session; defaults `role` to
+  `'worker'` and `banned` to `false` when unset; returns `null` when there is no session.
+- `isAdmin` is true only for the `admin` role (false for `worker` and for `null`).
+- `adminGuard` returns 401 without a session, 403 for a non-admin, and 403 for a banned admin
+  that still holds a valid token; it passes through for an active admin. (Exercised through the
+  `/api/admin/*` surface in `admin-users.test.ts`.)
+- CORS: the allowed SPA origins (worker 5173, admin 5174) are echoed on the
+  `access-control-allow-origin` header, OPTIONS preflight is answered with the allowed methods,
+  and `set-auth-token` is exposed so the SPA can read the bearer on sign-in.