test(server): Phase 3 — HTTP route integration (auth + RBAC guards)

Boots the REAL Fastify app over a fresh in-memory DB (buildServer({ db }), driven by
app.inject — no listen) to exercise the security seam end to end:

- routes.test.ts (7): /health open; login rejects bad creds and sets token+csrf
  cookies on good ones; an unauthenticated GET /api/occupancy is 401; a site:read-only
  role GETs occupancy but is 403 on PUT /api/site-config (the permission gate, with a
  valid CSRF so the 403 is the perm check); an admin passes the same PUT; and a mutation
  with the auth cookie but NO csrf header is 403 (double-submit enforced).

Adds seedUser()/login() helpers (real bcrypt + the real /api/auth/login route) and
LOG_LEVEL=silent in the vitest env so asserted 401/403 responses don't flood output.

server 75/75 green (8 suites).

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/vitest.config.ts

@@ -10,6 +10,9 @@ export default defineConfig({
     env: {
       EVENT_SIGNING_KEY: "test-event-signing-key-0123456789",
       JWT_SECRET: "test-jwt-secret-0123456789abcdef",
+      // Silence the Fastify request logger — route tests assert 401/403 responses,
+      // whose error logs would otherwise flood the test output.
+      LOG_LEVEL: "silent",
     },
   },
 });