test(server): add fresh-SQLite test harness + anti-fraud core suites

Foundation for testing every service. Adds @parking/db/testing — createTestDb()
spins a fresh in-memory SQLite and applies the real Drizzle migrations, so server
tests run against the production schema with zero live-DB risk.

Wires Vitest into apps/server (test script + config; test signing keys via env)
and adds the first Phase-1 suites against the anti-fraud core:

- signer.test.ts (10): sign/verify round-trip, tamper + forgery rejection,
  malformed-signature guard, determinism, keyId rotation (buildVerifier).
- event-log.test.ts (12): monotonic index, prevHash linkage, payload-in-signature,
  append serialization, and verifyChain() catching every tamper class — edited
  payload, deleted row (index gap), broken prevHash, unknown keyId — plus
  canonicalize byte-stability.

Also stops *.test.ts leaking into shipped dist/ (tsconfig exclude in server +
shared; shared had been emitting compiled tests all along).

server 22/22, shared 87/87 green.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

packages/db/package.json

@@ -11,6 +11,10 @@
     "./schema": {
       "types": "./dist/schema.d.ts",
       "default": "./dist/schema.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
     }
   },
   "main": "./dist/index.js",

packages/db/src/testing.ts

@@ -0,0 +1,32 @@
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+import * as schema from "./schema.js";
+import type { Db } from "./index.js";
+
+// Test-only helper: a fresh, fully-migrated SQLite database with NO live-DB risk.
+// Every server/integration test spins one of these so suites are isolated and
+// deterministic — never the real parking.sqlite. Not exported from the package
+// root (`@parking/db`); import it from `@parking/db/testing` in test code only.
+
+// The migrations live next to this package's compiled output. From dist/testing.js
+// that's ../drizzle; resolve it off import.meta.url so it works regardless of the
+// caller's cwd (tests run from apps/server, packages/devices, etc.).
+const MIGRATIONS_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "../drizzle");
+
+/**
+ * Open an in-memory SQLite (or a temp file if `url` is given), apply every Drizzle
+ * migration in order, and return a typed Drizzle handle plus the raw better-sqlite3
+ * connection (so a test can assert raw rows or `.close()` it). The schema matches
+ * production exactly because it's the SAME migration set, not a hand-rolled DDL.
+ */
+export function createTestDb(url = ":memory:"): { db: Db; sqlite: Database.Database; close: () => void } {
+  const sqlite = new Database(url);
+  sqlite.pragma("journal_mode = WAL");
+  sqlite.pragma("foreign_keys = ON");
+  const db = drizzle(sqlite, { schema }) as Db;
+  migrate(db, { migrationsFolder: MIGRATIONS_DIR });
+  return { db, sqlite, close: () => sqlite.close() };
+}