feat(api): Drizzle + libsql DB layer with better-auth schema and migrations

apps/api/test/db.test.ts

@@ -0,0 +1,10 @@
+import { describe, it, expect } from 'vitest';
+import { db } from '../src/db/client';
+import { user } from '../src/db/schema';
+
+describe('database', () => {
+  it('can query the migrated user table (empty)', async () => {
+    const rows = await db.select().from(user);
+    expect(rows).toEqual([]);
+  });
+});

apps/api/test/setup.ts

@@ -1,2 +1,19 @@
-// Placeholder until Task 3 adds DB migration to the test setup.
-export {};
+import { beforeAll } from 'vitest';
+import { rmSync, mkdirSync } from 'node:fs';
+
+// Use a dedicated, freshly-migrated file DB for the test run.
+process.env.DATABASE_URL = 'file:./.tmp/test.db';
+process.env.BETTER_AUTH_SECRET = 'test-secret';
+process.env.BETTER_AUTH_URL = 'http://localhost:3000';
+
+// Reset the scratch DB at top level — setup files run before the test-file
+// module graph (and thus before db/client.ts opens, and locks, the file on
+// Windows). Doing this inside beforeAll would race the open libsql handle and
+// fail with EBUSY on unlink.
+rmSync('./.tmp', { recursive: true, force: true });
+mkdirSync('./.tmp', { recursive: true });
+
+beforeAll(async () => {
+  const { runMigrations } = await import('../src/db/migrate');
+  await runMigrations();
+});