test: add initial unit integration and e2e coverage

Adds the initial testing baseline for the project:

   Unit coverage:
   - Zod schemas for items, assignments, movements, categories, auth, recipients, users, and assets
   - password hashing and verification helpers
   - auth role helper functions

   Integration coverage with PostgreSQL Testcontainers:
   - item use-cases: create, duplicate names, delete constraints
   - assignment use-cases: create, insufficient stock, return, double return
   - asset use-cases: available/assigned creation and lifecycle transitions
   - user use-cases: create/update, uniqueness, admin safeguards, password reset
   - category use-cases: create/update/delete constraints
   - recipient use-cases: create/update and uniqueness constraints

   E2E smoke coverage with Playwright:
   - unauthenticated redirect to login
   - seeded admin login
   - dashboard load
   - admin users page
   - inventory items page
   - assignments page

   Also configures:
   - Vitest
   - Playwright
   - PostgreSQL Testcontainers helpers
   - deterministic E2E admin bootstrap
   - test artifact ignores

   Validation:
   - bun run test: 9 files / 37 tests passed
   - bun run test:e2e: 3 passed
   - bunx tsc --noEmit: passed
   - bunx prisma validate: passed

tests/unit/services/auth.service.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it, vi } from "vitest"
+
+vi.mock("next/navigation", () => ({
+  redirect: vi.fn((path: string) => {
+    throw new Error(`redirect:${path}`)
+  }),
+}))
+
+vi.mock("@/lib/auth", () => ({
+  auth: vi.fn(),
+}))
+
+import type { Session } from "next-auth"
+import {
+  hasAnyRole,
+  hasMinimumRole,
+  hasRole,
+  isAdmin,
+} from "@/services/auth.service"
+
+function sessionWithRole(role: Session["user"]["role"]): Session {
+  return {
+    expires: new Date(Date.now() + 60_000).toISOString(),
+    user: {
+      id: "user-id",
+      name: "Test User",
+      email: "test@example.test",
+      role,
+    },
+  }
+}
+
+describe("auth service role helpers", () => {
+  it("checks exact roles", () => {
+    const admin = sessionWithRole("ADMIN")
+    const staff = sessionWithRole("STAFF")
+
+    expect(hasRole(admin, "ADMIN")).toBe(true)
+    expect(hasRole(staff, "ADMIN")).toBe(false)
+    expect(hasRole(null, "ADMIN")).toBe(false)
+  })
+
+  it("checks any allowed role", () => {
+    const manager = sessionWithRole("MANAGER")
+
+    expect(hasAnyRole(manager, ["ADMIN", "MANAGER"])).toBe(true)
+    expect(hasAnyRole(manager, ["ADMIN", "STAFF"])).toBe(false)
+    expect(hasAnyRole(null, ["ADMIN", "MANAGER"])).toBe(false)
+  })
+
+  it("checks minimum role hierarchy", () => {
+    expect(hasMinimumRole(sessionWithRole("ADMIN"), "MANAGER")).toBe(true)
+    expect(hasMinimumRole(sessionWithRole("MANAGER"), "STAFF")).toBe(true)
+    expect(hasMinimumRole(sessionWithRole("STAFF"), "MANAGER")).toBe(false)
+    expect(hasMinimumRole(sessionWithRole("VIEWER"), "STAFF")).toBe(false)
+    expect(hasMinimumRole(null, "VIEWER")).toBe(false)
+  })
+
+  it("identifies admins", () => {
+    expect(isAdmin(sessionWithRole("ADMIN"))).toBe(true)
+    expect(isAdmin(sessionWithRole("MANAGER"))).toBe(false)
+    expect(isAdmin(null)).toBe(false)
+  })
+})