test: apply suite review improvements (01–11)

- Fix SEC-005: rewrite path traversal test to upload a real file, inject
  traversal filename into DB, and assert the download does not succeed
- Fix SEC-007: rename misleading test description to reflect it tests
  rejection of an invalid token, not acceptance of a valid one
- Delete health.test.ts: all 3 tests were exact duplicates of auth.test.ts
  and misc.test.ts
- Remove duplicate describe blocks from misc.test.ts: Categories endpoint
  (duplicate of categories.test.ts) and App config (duplicate of auth.test.ts)
- Remove TRIP-016 from trips.test.ts: weaker duplicate of TRIP-007 (no body
  assertion)
- Remove API Keys describe block from profile.test.ts: canonical copy lives
  in security.test.ts where it belongs
- Remove avatarUrl describe block from budgetService.test.ts: identical tests
  already exist in authService.test.ts; drop now-unused import
- Add DB verification to ASSIGN-007 and PACK-006 reorder tests: query
  day_assignments / packing_items after PUT reorder to confirm order changed
- Strengthen BUDGET-007/008/009: add member/payer setup and assert concrete
  values (total_paid, per-user balance, flow direction and amount)
- Remove 6 pointless Map-semantics tests from inAppNotificationActions.test.ts;
  keep only the two built-in registration checks
- Remove 5 passthrough tests from queryHelpers.test.ts; keep the 4 tests that
  cover actual flat-to-nested transformation logic

server/tests/integration/misc.test.ts

@@ -119,24 +119,3 @@ describe('Force HTTPS redirect', () => {
   });
 });
 
-describe('Categories endpoint', () => {
-  it('MISC-013/PLACE-015 — GET /api/categories returns seeded categories', async () => {
-    const { user } = createUser(testDb);
-
-    const res = await request(app)
-      .get('/api/categories')
-      .set('Cookie', authCookie(user.id));
-    expect(res.status).toBe(200);
-    expect(Array.isArray(res.body.categories)).toBe(true);
-    expect(res.body.categories.length).toBeGreaterThan(0);
-  });
-});
-
-describe('App config', () => {
-  it('MISC-015 — GET /api/auth/app-config returns configuration', async () => {
-    const res = await request(app).get('/api/auth/app-config');
-    expect(res.status).toBe(200);
-    expect(res.body).toHaveProperty('allow_registration');
-    expect(res.body).toHaveProperty('oidc_configured');
-  });
-});