feat(16-04): update route tests and MCP tests for multi-user userId

- All 8 route test files destructure { db, userId } from createTestDb()
- All route test middleware sets c.set("userId", userId)
- MCP tools.test.ts passes userId to all registerXTools(db, userId) calls
- MCP tools.test.ts passes userId to getCollectionSummary(db, userId)
- Added 4 cross-user isolation tests for MCP tools (items, item by ID, threads, collection summary)
- OAuth test db type annotation updated for new createTestDb return shape
- Images test now uses createTestDb with userId context

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/routes/auth.test.ts

@@ -4,16 +4,17 @@ import { authRoutes } from "../../src/server/routes/auth.ts";
 import { createTestDb } from "../helpers/db.ts";
 
 function createTestApp() {
-	const db = createTestDb();
-	const app = new Hono<{ Variables: { db?: any } }>();
+	const { db, userId } = createTestDb();
+	const app = new Hono<{ Variables: { db?: any; userId?: number } }>();
 
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 
 	app.route("/api/auth", authRoutes);
-	return { app, db };
+	return { app, db, userId };
 }
 
 describe("Auth Routes", () => {

tests/routes/categories.test.ts

@@ -5,18 +5,19 @@ import { itemRoutes } from "../../src/server/routes/items.ts";
 import { createTestDb } from "../helpers/db.ts";
 
 function createTestApp() {
-	const db = createTestDb();
+	const { db, userId } = createTestDb();
 	const app = new Hono();
 
-	// Inject test DB into context for all routes
+	// Inject test DB and userId into context for all routes
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 
 	app.route("/api/categories", categoryRoutes);
 	app.route("/api/items", itemRoutes);
-	return { app, db };
+	return { app, db, userId };
 }
 
 describe("Category Routes", () => {

tests/routes/images.test.ts

@@ -1,8 +1,15 @@
 import { describe, expect, test } from "bun:test";
 import { Hono } from "hono";
 import { imageRoutes } from "../../src/server/routes/images";
+import { createTestDb } from "../helpers/db.ts";
 
+const { db, userId } = createTestDb();
 const app = new Hono();
+app.use("*", async (c, next) => {
+	c.set("db", db);
+	c.set("userId", userId);
+	await next();
+});
 app.route("/api/images", imageRoutes);
 
 describe("POST /api/images/from-url", () => {

tests/routes/items.test.ts

@@ -5,18 +5,19 @@ import { itemRoutes } from "../../src/server/routes/items.ts";
 import { createTestDb } from "../helpers/db.ts";
 
 function createTestApp() {
-	const db = createTestDb();
+	const { db, userId } = createTestDb();
 	const app = new Hono();
 
-	// Inject test DB into context for all routes
+	// Inject test DB and userId into context for all routes
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 
 	app.route("/api/items", itemRoutes);
 	app.route("/api/categories", categoryRoutes);
-	return { app, db };
+	return { app, db, userId };
 }
 
 describe("Item Routes", () => {

tests/routes/oauth.test.ts

@@ -7,28 +7,30 @@ import { createUser } from "../../src/server/services/auth.service.ts";
 import { createTestDb } from "../helpers/db.ts";
 
 function createTestApp() {
-	const db = createTestDb();
-	const app = new Hono<{ Variables: { db?: any } }>();
+	const { db, userId } = createTestDb();
+	const app = new Hono<{ Variables: { db?: any; userId?: number } }>();
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 	app.route("/.well-known", wellKnownRoute);
 	app.route("/oauth", oauthRoutes);
-	return { app, db };
+	return { app, db, userId };
 }
 
 function createFullTestApp() {
-	const db = createTestDb();
-	const app = new Hono<{ Variables: { db?: any } }>();
+	const { db, userId } = createTestDb();
+	const app = new Hono<{ Variables: { db?: any; userId?: number } }>();
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 	app.route("/.well-known", wellKnownRoute);
 	app.route("/oauth", oauthRoutes);
 	app.route("/mcp", mcpRoutes);
-	return { app, db };
+	return { app, db, userId };
 }
 
 function generatePkce() {
@@ -39,7 +41,7 @@ function generatePkce() {
 
 describe("OAuth Routes", () => {
 	let app: Hono;
-	let db: ReturnType<typeof createTestDb>;
+	let db: ReturnType<typeof createTestDb>["db"];
 
 	beforeEach(async () => {
 		const testApp = createTestApp();

tests/routes/params.test.ts

@@ -7,10 +7,11 @@ import { threadRoutes } from "../../src/server/routes/threads";
 import { createTestDb } from "../helpers/db";
 
 function createTestApp() {
-	const db = createTestDb();
+	const { db, userId } = createTestDb();
 	const app = new Hono();
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 	app.route("/api/items", itemRoutes);

tests/routes/setups.test.ts

@@ -5,17 +5,18 @@ import { setupRoutes } from "../../src/server/routes/setups.ts";
 import { createTestDb } from "../helpers/db.ts";
 
 function createTestApp() {
-	const db = createTestDb();
+	const { db, userId } = createTestDb();
 	const app = new Hono();
 
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 
 	app.route("/api/setups", setupRoutes);
 	app.route("/api/items", itemRoutes);
-	return { app, db };
+	return { app, db, userId };
 }
 
 async function createSetupViaAPI(app: Hono, name: string) {

tests/routes/threads.test.ts

@@ -4,17 +4,18 @@ import { threadRoutes } from "../../src/server/routes/threads.ts";
 import { createTestDb } from "../helpers/db.ts";
 
 function createTestApp() {
-	const db = createTestDb();
+	const { db, userId } = createTestDb();
 	const app = new Hono();
 
-	// Inject test DB into context for all routes
+	// Inject test DB and userId into context for all routes
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 
 	app.route("/api/threads", threadRoutes);
-	return { app, db };
+	return { app, db, userId };
 }
 
 async function createThreadViaAPI(app: Hono, name: string, categoryId = 1) {