test: DB-backed purchases access-logic integration tests

Commit notes

Adds purchases.integration.test.ts covering the real database-touching access logic against seeded rows (complements the pure-logic purchases.test.ts):

- hasPurchasedPack: free-pack access, creator-owned access, stranger denial, unknown pack, missing identifier, completed-purchase access by email (case-insensitive), other-email denial, and that non-completed (pending) purchases are ignored. - linkGuestPurchasesToUser: claims a completed guest purchase by email and flips userId-based access from false to true; returns 0 for no-match and empty args.

Seeds users/packs/purchases directly and cleans them up in afterAll. Guarded on infra.db only (no Redis needed), so it skips cleanly without Postgres and runs for real against a live DATABASE_URL. 12 tests.

Full suite: 153 pass / 35 skip / 0 fail.