fix(15): convert auth service/tests to async PGlite pattern

The executor agents wrote sync SQLite-style calls (.get(), .all(), .run())
instead of the async Postgres pattern established in Phase 14. Fixed:
- auth.service.ts: use await + destructuring for all DB operations
- auth routes: await listApiKeys
- All auth test files: async createTestDb(), await service calls

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/routes/auth.ts

@@ -33,7 +33,7 @@ app.get("/me", async (c) => {
 
 app.get("/keys", requireAuth, async (c) => {
 	const db = c.get("db");
-	const keys = listApiKeys(db);
+	const keys = await listApiKeys(db);
 	return c.json(keys);
 });
 

src/server/services/auth.service.ts

@@ -12,11 +12,10 @@ export async function createApiKey(db: Db = prodDb, name: string) {
 	const keyHash = await Bun.password.hash(rawKey);
 	const keyPrefix = rawKey.slice(0, 8);
 
-	const record = db
+	const [record] = await db
 		.insert(apiKeys)
 		.values({ name, keyHash, keyPrefix })
-		.returning()
-		.get();
+		.returning();
 
 	return { ...record, rawKey };
 }
@@ -26,11 +25,10 @@ export async function verifyApiKey(
 	rawKey: string,
 ): Promise<boolean> {
 	const prefix = rawKey.slice(0, 8);
-	const candidates = db
+	const candidates = await db
 		.select()
 		.from(apiKeys)
-		.where(eq(apiKeys.keyPrefix, prefix))
-		.all();
+		.where(eq(apiKeys.keyPrefix, prefix));
 
 	for (const candidate of candidates) {
 		const valid = await Bun.password.verify(rawKey, candidate.keyHash);
@@ -40,7 +38,7 @@ export async function verifyApiKey(
 	return false;
 }
 
-export function listApiKeys(db: Db = prodDb) {
+export async function listApiKeys(db: Db = prodDb) {
 	return db
 		.select({
 			id: apiKeys.id,
@@ -48,10 +46,9 @@ export function listApiKeys(db: Db = prodDb) {
 			keyPrefix: apiKeys.keyPrefix,
 			createdAt: apiKeys.createdAt,
 		})
-		.from(apiKeys)
-		.all();
+		.from(apiKeys);
 }
 
-export function deleteApiKey(db: Db = prodDb, id: number) {
-	db.delete(apiKeys).where(eq(apiKeys.id, id)).run();
+export async function deleteApiKey(db: Db = prodDb, id: number) {
+	await db.delete(apiKeys).where(eq(apiKeys.id, id));
 }