fix: resolve all 13 remaining test failures

- OAuth: add userId to oauth_codes schema and migration, derive userId
  from stored auth code/token record instead of passing separately
- Auth middleware tests: destructure {db, userId} from createTestDb,
  pass userId to createApiKey, fix error message assertion
- MCP tests: add missing await on getCollectionSummary and
  createSecondTestUser calls

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/db/schema.ts

@@ -57,6 +57,7 @@ export const items = pgTable("items", {
 	quantity: integer("quantity").notNull().default(1),
 	globalItemId: integer("global_item_id").references(() => globalItems.id),
 	purchasePriceCents: integer("purchase_price_cents"),
+	brand: text("brand"),
 	createdAt: timestamp("created_at").defaultNow().notNull(),
 	updatedAt: timestamp("updated_at").defaultNow().notNull(),
 });
@@ -210,6 +211,9 @@ export const oauthCodes = pgTable("oauth_codes", {
 	id: serial("id").primaryKey(),
 	code: text("code").notNull().unique(),
 	clientId: text("client_id").notNull(),
+	userId: integer("user_id")
+		.notNull()
+		.references(() => users.id),
 	codeChallenge: text("code_challenge").notNull(),
 	codeChallengeMethod: text("code_challenge_method").notNull().default("S256"),
 	redirectUri: text("redirect_uri").notNull(),