feat(16-04): update route tests and MCP tests for multi-user userId

- All 8 route test files destructure { db, userId } from createTestDb()
- All route test middleware sets c.set("userId", userId)
- MCP tools.test.ts passes userId to all registerXTools(db, userId) calls
- MCP tools.test.ts passes userId to getCollectionSummary(db, userId)
- Added 4 cross-user isolation tests for MCP tools (items, item by ID, threads, collection summary)
- OAuth test db type annotation updated for new createTestDb return shape
- Images test now uses createTestDb with userId context

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/routes/params.test.ts

@@ -7,10 +7,11 @@ import { threadRoutes } from "../../src/server/routes/threads";
 import { createTestDb } from "../helpers/db";
 
 function createTestApp() {
-	const db = createTestDb();
+	const { db, userId } = createTestDb();
 	const app = new Hono();
 	app.use("*", async (c, next) => {
 		c.set("db", db);
+		c.set("userId", userId);
 		await next();
 	});
 	app.route("/api/items", itemRoutes);