feat(16-04): update all service tests to pass userId and add isolation tests

- Destructure { db, userId } from createTestDb() in all 8 service test files
- Pass userId to every service function call
- Add cross-user isolation tests for items, categories, threads, setups
- Add composite unique constraint test for categories
- Update verifyApiKey assertions to check { userId } return
- Update verifyAccessToken assertions to check { userId } return
- Pass userId to exchangeCode and refreshAccessToken calls

tests/services/totals.test.ts

@@ -9,28 +9,32 @@ import { createTestDb } from "../helpers/db.ts";
 
 describe("Totals Service", () => {
 	let db: any;
+	let userId: number;
 
 	beforeEach(async () => {
-		db = await createTestDb();
+		({ db, userId } = await createTestDb());
 	});
 
 	describe("getCategoryTotals", () => {
 		it("returns weight sum, cost sum, item count per category", async () => {
-			const shelter = await createCategory(db, { name: "Shelter", icon: "tent" });
-			await createItem(db, {
+			const shelter = await createCategory(db, userId, {
+				name: "Shelter",
+				icon: "tent",
+			});
+			await createItem(db, userId, {
 				name: "Tent",
 				weightGrams: 1200,
 				priceCents: 35000,
 				categoryId: shelter?.id,
 			});
-			await createItem(db, {
+			await createItem(db, userId, {
 				name: "Tarp",
 				weightGrams: 300,
 				priceCents: 8000,
 				categoryId: shelter?.id,
 			});
 
-			const totals = await getCategoryTotals(db);
+			const totals = await getCategoryTotals(db, userId);
 			expect(totals).toHaveLength(1); // Only Shelter has items
 			expect(totals[0].categoryName).toBe("Shelter");
 			expect(totals[0].totalWeight).toBe(1500);
@@ -39,29 +43,29 @@ describe("Totals Service", () => {
 		});
 
 		it("excludes empty categories (no items)", async () => {
-			await createCategory(db, { name: "Shelter", icon: "tent" });
+			await createCategory(db, userId, { name: "Shelter", icon: "tent" });
 			// No items added
-			const totals = await getCategoryTotals(db);
+			const totals = await getCategoryTotals(db, userId);
 			expect(totals).toHaveLength(0);
 		});
 	});
 
 	describe("getGlobalTotals", () => {
 		it("returns overall weight, cost, count", async () => {
-			await createItem(db, {
+			await createItem(db, userId, {
 				name: "Tent",
 				weightGrams: 1200,
 				priceCents: 35000,
 				categoryId: 1,
 			});
-			await createItem(db, {
+			await createItem(db, userId, {
 				name: "Spork",
 				weightGrams: 20,
 				priceCents: 500,
 				categoryId: 1,
 			});
 
-			const totals = await getGlobalTotals(db);
+			const totals = await getGlobalTotals(db, userId);
 			expect(totals).toBeDefined();
 			expect(totals?.totalWeight).toBe(1220);
 			expect(totals?.totalCost).toBe(35500);
@@ -69,7 +73,7 @@ describe("Totals Service", () => {
 		});
 
 		it("returns zeros when no items exist", async () => {
-			const totals = await getGlobalTotals(db);
+			const totals = await getGlobalTotals(db, userId);
 			expect(totals).toBeDefined();
 			expect(totals?.totalWeight).toBe(0);
 			expect(totals?.totalCost).toBe(0);