fix: resolve all 13 remaining test failures

- OAuth: add userId to oauth_codes schema and migration, derive userId
  from stored auth code/token record instead of passing separately
- Auth middleware tests: destructure {db, userId} from createTestDb,
  pass userId to createApiKey, fix error message assertion
- MCP tests: add missing await on getCollectionSummary and
  createSecondTestUser calls

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

drizzle-pg/0002_wakeful_vermin.sql

@@ -15,6 +15,9 @@ ALTER TABLE "items" ADD COLUMN "global_item_id" integer;--> statement-breakpoint
 ALTER TABLE "items" ADD COLUMN "purchase_price_cents" integer;--> statement-breakpoint
 ALTER TABLE "items" ADD COLUMN "brand" text;--> statement-breakpoint
 ALTER TABLE "thread_candidates" ADD COLUMN "global_item_id" integer;--> statement-breakpoint
+ALTER TABLE "oauth_codes" ADD COLUMN "user_id" integer NOT NULL DEFAULT 0;--> statement-breakpoint
+ALTER TABLE "oauth_codes" ALTER COLUMN "user_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "oauth_codes" ADD CONSTRAINT "oauth_codes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
 UPDATE "items" SET "global_item_id" = (
   SELECT "global_item_id" FROM "item_global_links"
   WHERE "item_global_links"."item_id" = "items"."id"