test: L1 integration harness (Postgres-backed, fundless)

- shared build_router() (lib) so main + tests exercise identical wiring
- tests/common: spins the real router + AppState against TEST_DATABASE_URL;
  self-skips when unset (cargo test stays green without a DB). Deterministic,
  non-secret test JWT/peppers; ephemeral generated identities only — no funded
  or sensitive wallet seeds (those stay in a separate gitignored L3 harness).
- tests/db_queries: validates migrations + db layer against real Postgres
  (peppered identity lookups, UNIQUE->409, session create/lookup/revoke,
  key upsert/list/delete, restore-attempt counts).
- tests/auth_flow: HTTP flows through the real router (health, auth gate,
  refresh rotation + old-token revocation, username set+lookup, key register+
  fetch, NIP-05 directory).
- CI: new integration job with an ephemeral postgres:16 service.
- 82 tests total (69 unit + 13 integration), all green against live PG.

Complements the monorepo's client-side suite (it tests the wire format the
client sends; the client tests the wallet side); mirrors its secret-handling
(env-driven, gitignored). Mirrors the L0-L5 tiering from docs/engineering.

src/lib.rs

@@ -18,6 +18,7 @@ pub mod models;
 use std::collections::HashMap;
 use std::sync::Arc;
 
+use axum::{routing::get, Router};
 use tokio::sync::RwLock;
 
 use crate::config::Config;
@@ -34,3 +35,19 @@ pub struct AppState {
     /// a shared/stateless variant is the load-balanced-fleet path.
     pub web_challenges: Arc<RwLock<HashMap<String, WebChallenge>>>,
 }
+
+/// Assemble the full application router with every route mounted and state
+/// applied. Shared by `main` and the integration-test harness so both exercise
+/// the exact same wiring: `/health` and the NIP-05 directory at the root, the
+/// authenticated wallet/identity API nested under `/api/v1`.
+pub fn build_router(state: Arc<AppState>) -> Router {
+    let api_v1 = api::auth::routes()
+        .merge(api::website::routes())
+        .merge(api::users::routes());
+
+    Router::new()
+        .route("/health", get(api::health::health))
+        .merge(api::nip05::routes())
+        .nest("/api/v1", api_v1)
+        .with_state(state)
+}

src/main.rs

@@ -6,11 +6,10 @@
 
 use std::sync::Arc;
 
-use axum::{routing::get, Router};
 use sqlx::postgres::PgPoolOptions;
 
 use smirk_backend_core::{
-    api::health, config::Config, core::session::SessionManager, infra::db::Database, AppState,
+    build_router, config::Config, core::session::SessionManager, infra::db::Database, AppState,
 };
 
 #[tokio::main]
@@ -57,15 +56,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         });
     }
 
-    let api_v1 = smirk_backend_core::api::auth::routes()
-        .merge(smirk_backend_core::api::website::routes())
-        .merge(smirk_backend_core::api::users::routes());
-
-    let app = Router::new()
-        .route("/health", get(health::health))
-        .merge(smirk_backend_core::api::nip05::routes())
-        .nest("/api/v1", api_v1)
-        .with_state(state);
+    let app = build_router(state);
 
     let listener = tokio::net::TcpListener::bind(&addr).await?;
     tracing::info!("smirk-backend-core listening on http://{addr}");