test: real DB-backed auth integration suite + SessionStart hook

Commit notes

Replaces the two fake auth tests (auth.test.ts / auth.integration.test.ts), which built throwaway in-memory Elysia apps and tested reimplemented logic, with a suite that mounts the REAL authRoutes and exercises the full register -> login -> /me -> refresh -> logout flow against the actual database + Redis-backed rate limiter:

- helpers/infra.ts: fast raw-TCP probe for Postgres/Redis (no ioredis/pg retry machinery), memoized; lets suites decide run-vs-skip. - helpers/auth-harness.ts: mounts production authRoutes with the subset of the global error mapping the flows rely on (AuthError->401/403, RateLimitError->429, validation->400); plus a request helper. - auth.routes.test.ts: 17 tests covering happy paths, duplicate email, validation, generic 'Invalid credentials' messaging, token/no-token/ garbage-token on /me, refresh rotation, and logout revocation. Guarded by describe.skipIf so it skips cleanly where Postgres/Redis are absent and runs for real where they exist. Cleans up created users via cascade. - setup.ts: env vars now use ||= so a real DATABASE_URL/REDIS_URL can be injected (CI secret / SessionStart hook / .env) to activate the suite.

Adds a SessionStart hook (.claude/hooks/session-start.sh + settings.json) for Claude Code on the web: installs deps with bun install and, best-effort, brings up Postgres+Redis via docker compose, applies migrations, and exports DATABASE_URL/REDIS_URL so DB-backed suites run in future web sessions. The infra step never fails the session — without Docker the suites just skip.

Full suite: 153 pass / 23 skip / 0 fail.