fix: resolve Bun mock isolation contamination across test files

- storage.service.ts: use dynamic import() inside each function so the
  current @aws-sdk mock is always picked up regardless of module load order
- images.test.ts + image.service.test.ts: replace module-level storage.service
  mock with @aws-sdk/client-s3 mock to avoid contaminating storage.service.test.ts
- routes/auth.test.ts: remove unnecessary oauth.service mock (no test uses
  verifyAccessToken) which was contaminating oauth.service.test.ts
- middleware/auth.test.ts: complete oauth.service mock shape with all exports

All 464 tests now pass in a single bun test run.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/services/image.service.test.ts

@@ -9,10 +9,34 @@ import {
 } from "bun:test";
 import type { Server } from "bun";
 
-// Mock the storage service before importing image service
-const mockUploadImage = mock(() => Promise.resolve());
-mock.module("../../src/server/services/storage.service", () => ({
-	uploadImage: mockUploadImage,
+// Mock @aws-sdk/* so storage.service (used by image.service) doesn't make real
+// S3 calls — avoids contaminating storage.service.test.ts with a module-level mock.
+const mockSend = mock(() => Promise.resolve({}));
+mock.module("@aws-sdk/client-s3", () => ({
+	S3Client: class MockS3Client {
+		send = mockSend;
+	},
+	PutObjectCommand: class {
+		input: Record<string, unknown>;
+		constructor(input: Record<string, unknown>) {
+			this.input = input;
+		}
+	},
+	DeleteObjectCommand: class {
+		input: Record<string, unknown>;
+		constructor(input: Record<string, unknown>) {
+			this.input = input;
+		}
+	},
+	GetObjectCommand: class {
+		input: Record<string, unknown>;
+		constructor(input: Record<string, unknown>) {
+			this.input = input;
+		}
+	},
+}));
+mock.module("@aws-sdk/s3-request-presigner", () => ({
+	getSignedUrl: mock(() => Promise.resolve("https://example.com/test.png")),
 }));
 
 const { fetchImageFromUrl } = await import(
@@ -59,7 +83,7 @@ afterAll(() => {
 
 describe("Image Service", () => {
 	beforeEach(() => {
-		mockUploadImage.mockClear();
+		mockSend.mockClear();
 	});
 
 	describe("fetchImageFromUrl", () => {
@@ -70,13 +94,14 @@ describe("Image Service", () => {
 			expect(result.filename).toMatch(/^\d+-[\w-]+\.png$/);
 			expect(result.sourceUrl).toBe(imageUrl);
 
-			// Verify uploadImage was called with correct args
-			expect(mockUploadImage).toHaveBeenCalledTimes(1);
-			const [buffer, filename, contentType] = mockUploadImage.mock
-				.calls[0] as unknown[];
-			expect(buffer).toBeInstanceOf(Buffer);
-			expect(filename).toBe(result.filename);
-			expect(contentType).toBe("image/png");
+			// Verify S3 PutObjectCommand was issued with correct args
+			expect(mockSend).toHaveBeenCalledTimes(1);
+			const command = mockSend.mock.calls[0][0] as {
+				input: Record<string, unknown>;
+			};
+			expect(command.input.Body).toBeInstanceOf(Buffer);
+			expect(command.input.Key).toBe(result.filename);
+			expect(command.input.ContentType).toBe("image/png");
 		});
 
 		it("rejects non-image content type", async () => {