feat(auth): token service with single-use, hashed storage

packages/backend/src/tests/dbHelper.ts

@@ -1,9 +1,26 @@
 import { migrate } from 'drizzle-orm/better-sqlite3/migrator';
 import { resolve } from 'node:path';
 import { createDb, type Db } from '../db/client.js';
+import { users } from '../db/schema.js';
+import type { UserRow } from '../db/schema.js';
 
 export function makeTestDb(): { db: Db; close: () => void } {
   const { db, sqlite } = createDb(':memory:');
   migrate(db, { migrationsFolder: resolve(import.meta.dirname, '../../drizzle') });
   return { db, close: () => sqlite.close() };
 }
+
+export async function createUserDirect(
+  db: Db,
+  init: { email: string; displayName?: string; role?: 'user' | 'sysadmin'; passwordHash?: string | null; emailVerifiedAt?: number | null; isActive?: boolean }
+): Promise<UserRow> {
+  const [row] = db.insert(users).values({
+    email: init.email,
+    displayName: init.displayName ?? 'Test User',
+    role: init.role ?? 'user',
+    passwordHash: init.passwordHash ?? null,
+    emailVerifiedAt: init.emailVerifiedAt ?? null,
+    isActive: init.isActive ?? true,
+  }).returning().all();
+  return row!;
+}