test: L1 integration harness (Postgres-backed, fundless)

- shared build_router() (lib) so main + tests exercise identical wiring
- tests/common: spins the real router + AppState against TEST_DATABASE_URL;
  self-skips when unset (cargo test stays green without a DB). Deterministic,
  non-secret test JWT/peppers; ephemeral generated identities only — no funded
  or sensitive wallet seeds (those stay in a separate gitignored L3 harness).
- tests/db_queries: validates migrations + db layer against real Postgres
  (peppered identity lookups, UNIQUE->409, session create/lookup/revoke,
  key upsert/list/delete, restore-attempt counts).
- tests/auth_flow: HTTP flows through the real router (health, auth gate,
  refresh rotation + old-token revocation, username set+lookup, key register+
  fetch, NIP-05 directory).
- CI: new integration job with an ephemeral postgres:16 service.
- 82 tests total (69 unit + 13 integration), all green against live PG.

Complements the monorepo's client-side suite (it tests the wire format the
client sends; the client tests the wallet side); mirrors its secret-handling
(env-driven, gitignored). Mirrors the L0-L5 tiering from docs/engineering.

src/main.rs

@@ -6,11 +6,10 @@
 
 use std::sync::Arc;
 
-use axum::{routing::get, Router};
 use sqlx::postgres::PgPoolOptions;
 
 use smirk_backend_core::{
-    api::health, config::Config, core::session::SessionManager, infra::db::Database, AppState,
+    build_router, config::Config, core::session::SessionManager, infra::db::Database, AppState,
 };
 
 #[tokio::main]
@@ -57,15 +56,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         });
     }
 
-    let api_v1 = smirk_backend_core::api::auth::routes()
-        .merge(smirk_backend_core::api::website::routes())
-        .merge(smirk_backend_core::api::users::routes());
-
-    let app = Router::new()
-        .route("/health", get(health::health))
-        .merge(smirk_backend_core::api::nip05::routes())
-        .nest("/api/v1", api_v1)
-        .with_state(state);
+    let app = build_router(state);
 
     let listener = tokio::net::TcpListener::bind(&addr).await?;
     tracing::info!("smirk-backend-core listening on http://{addr}");