[AZ-456] Test infrastructure: Vitest + MSW + Playwright + scripts

Scaffolds the Blackbox test project per AZ-456 / environment.md across
the three profiles:

- fast  : Vitest 3.x + jsdom + MSW 2.x + RTL/jest-dom; tests/setup.ts
          boots the MSW Node server with onUnhandledRequest:'error',
          afterEach resets handlers, clears bearer + navigate-to-login
          spy. Default handlers ship for every suite service plus OWM
          and tile stand-ins. Fixtures mirror seed_* in test-data.md.
- e2e   : Playwright ^1.49 with chromium + firefox projects against the
          suite docker-compose stack; owm-stub + tile-stub Bun servers,
          playwright-runner image, seeds.sql for the test-db.
- static: scripts/run-tests.sh extended — tsc --noEmit (test config),
          vite build, ripgrep checks (with grep -r fallback), CSV
          report at test-output/static-report.csv per AC-7 columns.

Smoke tests cover AC-3, AC-4 (fast, 5 tests, PASS) and AC-1, AC-2,
AC-5, AC-8 (e2e, gated by Risk 4 docker availability). Static profile
(13 checks) PASS — STC-SEC1 (no literal OWM key) lifted from
QUARANTINE per AZ-447 with a narrowed pattern.

Files:
  +24 tests/**, +10 e2e/**, +vitest.config.ts, +tsconfig.test.json
  ~package.json (test scripts + devDeps for vitest, @testing-library/*,
   msw, @playwright/test, jsdom, @types/node, @vitest/coverage-v8)
  ~scripts/run-tests.sh, scripts/run-performance-tests.sh — switched
   RESULTS_DIR to test-output/, compose path to project-local
  ~.gitignore — added /test-output/

Verification:
  bun run test:fast        → 11 / 11 PASS
  ./scripts/run-tests.sh   → static 13/13 + fast 11/11 PASS, exit 0

Tracker: AZ-456 → In Testing.
Co-authored-by: Cursor <cursoragent@cursor.com>

tests/helpers/auth.ts

@@ -0,0 +1,13 @@
+import { setToken } from '../../src/api/client'
+
+// Stand-in for the full login flow. Tests that need an authenticated request
+// call `seedBearer(token)` before the request fires; `clearBearer()` is
+// idempotent and runs as a safety net in afterEach (see tests/setup.ts).
+export function seedBearer(token = 'test-bearer-default'): string {
+  setToken(token)
+  return token
+}
+
+export function clearBearer(): void {
+  setToken(null)
+}

tests/helpers/navigate.ts

@@ -0,0 +1,11 @@
+import { vi, type MockedFunction } from 'vitest'
+import { setNavigateToLogin } from '../../src/api/client'
+
+// Replaces the production `navigateToLoginImpl` accessor (autodev Step 4 / C06)
+// with a Vitest spy. Tests assert "redirect was invoked" via the returned
+// function reference instead of stubbing window.location globally.
+export function seedNavigateToLogin(): MockedFunction<() => void> {
+  const spy = vi.fn()
+  setNavigateToLogin(spy)
+  return spy
+}

tests/helpers/render.tsx

@@ -0,0 +1,39 @@
+import type { ReactElement, ReactNode } from 'react'
+import { render, type RenderOptions, type RenderResult } from '@testing-library/react'
+import { MemoryRouter } from 'react-router-dom'
+import { I18nextProvider } from 'react-i18next'
+import i18n from '../../src/i18n/i18n'
+import { AuthProvider } from '../../src/auth/AuthContext'
+
+export interface RenderWithProvidersOptions extends RenderOptions {
+  /** Initial route(s) for the in-memory router. Defaults to ['/']. */
+  initialEntries?: string[]
+  /** Initial entry index. Defaults to 0. */
+  initialIndex?: number
+  /** Skip wrapping in <AuthProvider>. Useful for tests that mock auth themselves. */
+  withoutAuth?: boolean
+  /** Skip wrapping in <I18nextProvider>. */
+  withoutI18n?: boolean
+}
+
+export function renderWithProviders(
+  ui: ReactElement,
+  {
+    initialEntries = ['/'],
+    initialIndex = 0,
+    withoutAuth,
+    withoutI18n,
+    ...rtl
+  }: RenderWithProvidersOptions = {},
+): RenderResult {
+  const Wrapper = ({ children }: { children: ReactNode }) => {
+    let tree = <MemoryRouter initialEntries={initialEntries} initialIndex={initialIndex}>{children}</MemoryRouter>
+    if (!withoutAuth) tree = <AuthProvider>{tree}</AuthProvider>
+    if (!withoutI18n) tree = <I18nextProvider i18n={i18n}>{tree}</I18nextProvider>
+    return tree
+  }
+  return render(ui, { wrapper: Wrapper, ...rtl })
+}
+
+export { screen, within, fireEvent, waitFor, act } from '@testing-library/react'
+export { default as userEvent } from '@testing-library/user-event'

tests/helpers/sse-mock.ts

@@ -0,0 +1,59 @@
+// SSE stand-in for the fast profile. MSW 2.x does not have first-class
+// EventSource support (see AZ-456 Risk 3); jsdom does not ship one either.
+// `simulateSseStream` returns a fake EventSource that tests inject in place
+// of the global where production code allows it (e2e Playwright covers
+// SSE end-to-end where the real EventSource is exercised against the suite).
+
+export interface SseEvent<T = unknown> {
+  event?: string
+  data: T
+  id?: string
+}
+
+export interface FakeEventSource extends EventTarget {
+  readyState: 0 | 1 | 2
+  url: string
+  close(): void
+  emit<T>(e: SseEvent<T>): void
+  emitError(err?: Event): void
+}
+
+const READY_CONNECTING = 0 as const
+const READY_OPEN = 1 as const
+const READY_CLOSED = 2 as const
+
+export function createFakeEventSource(url = 'about:blank'): FakeEventSource {
+  const target = new EventTarget() as FakeEventSource
+  ;(target as { readyState: 0 | 1 | 2 }).readyState = READY_CONNECTING
+  ;(target as { url: string }).url = url
+
+  // Move to "open" on the next microtask so listeners attached synchronously
+  // after construction still see the open event (matches the production
+  // EventSource handshake behavior closely enough for assertions).
+  queueMicrotask(() => {
+    ;(target as { readyState: 0 | 1 | 2 }).readyState = READY_OPEN
+    target.dispatchEvent(new Event('open'))
+  })
+
+  target.close = () => {
+    ;(target as { readyState: 0 | 1 | 2 }).readyState = READY_CLOSED
+  }
+  target.emit = <T>(e: SseEvent<T>) => {
+    if (target.readyState !== READY_OPEN) return
+    const payload = typeof e.data === 'string' ? e.data : JSON.stringify(e.data)
+    const message = new MessageEvent(e.event ?? 'message', { data: payload, lastEventId: e.id })
+    target.dispatchEvent(message)
+  }
+  target.emitError = (err?: Event) => {
+    target.dispatchEvent(err ?? new Event('error'))
+  }
+  return target
+}
+
+export function simulateSseStream<T = unknown>(events: Array<SseEvent<T>>): FakeEventSource {
+  const source = createFakeEventSource()
+  queueMicrotask(() => {
+    for (const e of events) source.emit(e)
+  })
+  return source
+}