test: apply suite review improvements (01–11)

- Fix SEC-005: rewrite path traversal test to upload a real file, inject
  traversal filename into DB, and assert the download does not succeed
- Fix SEC-007: rename misleading test description to reflect it tests
  rejection of an invalid token, not acceptance of a valid one
- Delete health.test.ts: all 3 tests were exact duplicates of auth.test.ts
  and misc.test.ts
- Remove duplicate describe blocks from misc.test.ts: Categories endpoint
  (duplicate of categories.test.ts) and App config (duplicate of auth.test.ts)
- Remove TRIP-016 from trips.test.ts: weaker duplicate of TRIP-007 (no body
  assertion)
- Remove API Keys describe block from profile.test.ts: canonical copy lives
  in security.test.ts where it belongs
- Remove avatarUrl describe block from budgetService.test.ts: identical tests
  already exist in authService.test.ts; drop now-unused import
- Add DB verification to ASSIGN-007 and PACK-006 reorder tests: query
  day_assignments / packing_items after PUT reorder to confirm order changed
- Strengthen BUDGET-007/008/009: add member/payer setup and assert concrete
  values (total_paid, per-user balance, flow direction and amount)
- Remove 6 pointless Map-semantics tests from inAppNotificationActions.test.ts;
  keep only the two built-in registration checks
- Remove 5 passthrough tests from queryHelpers.test.ts; keep the 4 tests that
  cover actual flat-to-nested transformation logic

server/tests/unit/services/budgetService.test.ts

@@ -29,7 +29,7 @@ const mockDb = vi.hoisted(() => {
 
 vi.mock('../../../src/db/database', () => mockDb);
 
-import { calculateSettlement, avatarUrl } from '../../../src/services/budgetService';
+import { calculateSettlement } from '../../../src/services/budgetService';
 import type { BudgetItem, BudgetItemMember } from '../../../src/types';
 
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -65,22 +65,6 @@ beforeEach(() => {
   setupDb([], []);
 });
 
-// ── avatarUrl ────────────────────────────────────────────────────────────────
-
-describe('avatarUrl', () => {
-  it('returns /uploads/avatars/<filename> when avatar is set', () => {
-    expect(avatarUrl({ avatar: 'photo.jpg' })).toBe('/uploads/avatars/photo.jpg');
-  });
-
-  it('returns null when avatar is null', () => {
-    expect(avatarUrl({ avatar: null })).toBeNull();
-  });
-
-  it('returns null when avatar is undefined', () => {
-    expect(avatarUrl({})).toBeNull();
-  });
-});
-
 // ── calculateSettlement ──────────────────────────────────────────────────────
 
 describe('calculateSettlement', () => {

server/tests/unit/services/inAppNotificationActions.test.ts

@@ -0,0 +1,21 @@
+/**
+ * Unit tests for inAppNotificationActions — NOTIF-ACT-001 through NOTIF-ACT-008.
+ * Pure Map registry — no DB or external dependencies.
+ */
+import { describe, it, expect } from 'vitest';
+import { getAction } from '../../../src/services/inAppNotificationActions';
+
+describe('getAction — built-in registrations', () => {
+  it('NOTIF-ACT-001 — test_approve is pre-registered', () => {
+    const handler = getAction('test_approve');
+    expect(handler).toBeDefined();
+    expect(typeof handler).toBe('function');
+  });
+
+  it('NOTIF-ACT-002 — test_deny is pre-registered', () => {
+    const handler = getAction('test_deny');
+    expect(handler).toBeDefined();
+    expect(typeof handler).toBe('function');
+  });
+
+});

server/tests/unit/services/queryHelpers.test.ts

@@ -48,17 +48,6 @@ const sampleParticipants: Participant[] = [
 ];
 
 describe('formatAssignmentWithPlace', () => {
-  it('returns correct top-level shape', () => {
-    const result = formatAssignmentWithPlace(makeRow(), sampleTags, sampleParticipants);
-    expect(result).toHaveProperty('id', 1);
-    expect(result).toHaveProperty('day_id', 10);
-    expect(result).toHaveProperty('order_index', 0);
-    expect(result).toHaveProperty('notes', 'assignment note');
-    expect(result).toHaveProperty('created_at');
-    expect(result).toHaveProperty('place');
-    expect(result).toHaveProperty('participants');
-  });
-
   it('nests place fields correctly from flat row', () => {
     const result = formatAssignmentWithPlace(makeRow(), [], []);
     const { place } = result;
@@ -100,24 +89,4 @@ describe('formatAssignmentWithPlace', () => {
     const result = formatAssignmentWithPlace(makeRow({ category_id: 0 as any }), [], []);
     expect(result.place.category).toBeNull();
   });
-
-  it('includes provided tags in place.tags', () => {
-    const result = formatAssignmentWithPlace(makeRow(), sampleTags, []);
-    expect(result.place.tags).toEqual(sampleTags);
-  });
-
-  it('defaults place.tags to [] when empty array provided', () => {
-    const result = formatAssignmentWithPlace(makeRow(), [], []);
-    expect(result.place.tags).toEqual([]);
-  });
-
-  it('includes provided participants', () => {
-    const result = formatAssignmentWithPlace(makeRow(), [], sampleParticipants);
-    expect(result.participants).toEqual(sampleParticipants);
-  });
-
-  it('defaults participants to [] when empty array provided', () => {
-    const result = formatAssignmentWithPlace(makeRow(), [], []);
-    expect(result.participants).toEqual([]);
-  });
 });