test(integration): un-skip 11 of 13 stale integration files (#3289)

[bokelley]

Summary

Walks through the umbrella in #3289 and un-skips everything that doesn't need a deeper architectural shift. +11 files un-skipped, +131 tests now run in CI, 0 failures.

	Before	After
Files green	35	46
Files file-skipped	11	2 (mcp-protocol, revenue-tracking)*
Files excluded via script	2	0 (script no longer needs --exclude)
Tests passing	465	596
Tests skipped	139	71

* Plus user-context (file-skip) and impersonation-audit (only the chat-driven describe is skipped — the schema describe runs).

What's in this PR

Auth-mock cluster (8 files). Old pattern:

vi.mock('../../src/middleware/auth.js', () => ({
  requireAuth: ..., requireAdmin: ...,
}));

…silently dropped every other auth.js export. HTTPServer setup imports optionalAuth and crashes during route registration → all 28 tests in admin-endpoints (etc.) get reported as skipped under a failed suite. Switched to:

vi.mock('../../src/middleware/auth.js', async (importOriginal) => ({
  ...(await importOriginal<typeof import('../../src/middleware/auth.js')>()),
  requireAuth: ..., requireAdmin: ...,
}));

Future auth additions don't re-break tests. CSRF middleware also gets a passthrough mock so POST/PUT/DELETE stop hitting 403 forbidden on the missing X-CSRF-Token cookie.

vi.hoisted for the excluded files. admin-sync-revenue-backfill and self-service-delete errored at module-eval time because vi.mock factories referenced top-level vars that aren't live until after factory hoisting. Shared mock state moves into vi.hoisted({...}). The WorkOS class mock now wires every new WorkOS() to the same shared instance methods, so per-test mockImplementation overrides retarget the right spy. --exclude flags are removed from test:server-integration.

health.test.ts. Dropped the stale (server as any).registry.initialize() beforeAll — HTTPServer no longer exposes .registry. The two failing-init tests went with it; the GET /health checks still match the live response shape.

mcp-protocol.test.ts. Bearer-auth gate cleared via MCP_AUTH_DISABLED=true at module-load. Stays describe.skip pending an SSE-format response-parser update — only blocker now is Content-Type: text/event-stream on the StreamableHTTP transport.

schema-routing.test.ts. Replaced localeCompare(numeric: true) with semver.rcompare so the test's "latest in 3.x" matches the alias-rewrite middleware (which prefers stable over prerelease at the same X.Y.Z).

digest-email-recipients.test.ts. Track-B counts were hardcoded to 3; the cert curriculum grew to 4. Reads the live count out of certification_modules so the test tracks curriculum changes instead of breaking on them.

member-db.test.ts. logo_url / brand_color etc. aren't part of CreateMemberProfileInput anymore and the create handler doesn't persist them. Test reduced to the documented input contract.

agent-visibility-e2e.test.ts. Fixed src/db/migrations/... path → server/src/db/migrations/....

Test env. WORKOS_COOKIE_PASSWORD set in revenue-tracking-env.ts setup so AUTH_ENABLED resolves true and workos!.userManagement is non-null in tests that reach for it.

Remaining (still tracked in #3289)

• mcp-protocol.test.ts — needs SSE-format parser
• revenue-tracking.test.ts — needs fuller stripe-client mock (webhooks.constructEvent + invoice/customer fixtures)
• user-context.test.ts (WorkOS-path tests) — needs richer WorkOS user-lookup mock
• impersonation-audit.test.ts (chat-driven describe) — needs working AddieClaudeClient init or refactor to unit-level coverage of audit-log helpers
• join-request-approval and personal-workspace-restrictions — 9 individual it.skip tests that need a per-file @workos-inc/node class mock so handlers' direct workos!.userManagement.* calls don't 401 against real WorkOS

Per-test skips now have inline comments describing exactly what blocks them, so the next person picking up #3289 can jump straight in.

Test plan

• CI: Server integration tests job goes green on this PR.
• Spot-check: npm run test:server-integration against a local Postgres reproduces 596 passed / 71 skipped.

🤖 Generated with Claude Code