Add comprehensive backend test suite (#339)

* add test suite, mostly covers integration testing, tests are only backend side

* workflow runs the correct script

* workflow runs the correct script

* workflow runs the correct script

* unit tests incoming

* Fix multer silent rejections and error handler info leak

- Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts,
  and files.ts so invalid uploads return an error instead of silently
  dropping the file
- Error handler in app.ts now always returns 500 / "Internal server
  error" instead of forwarding err.message to the client

* Use statusCode consistently for multer errors and error handler

- Error handler in app.ts reads err.statusCode to forward the correct
  HTTP status while keeping the response body generic

server/src/middleware/auth.ts

@@ -4,7 +4,7 @@ import { db } from '../db/database';
 import { JWT_SECRET } from '../config';
 import { AuthRequest, OptionalAuthRequest, User } from '../types';
 
-function extractToken(req: Request): string | null {
+export function extractToken(req: Request): string | null {
   // Prefer httpOnly cookie; fall back to Authorization: Bearer (MCP, API clients)
   const cookieToken = (req as any).cookies?.trek_session;
   if (cookieToken) return cookieToken;

server/src/middleware/mfaPolicy.ts

@@ -4,7 +4,7 @@ import { db } from '../db/database';
 import { JWT_SECRET } from '../config';
 
 /** Paths that never require MFA (public or pre-auth). */
-function isPublicApiPath(method: string, pathNoQuery: string): boolean {
+export function isPublicApiPath(method: string, pathNoQuery: string): boolean {
   if (method === 'GET' && pathNoQuery === '/api/health') return true;
   if (method === 'GET' && pathNoQuery === '/api/auth/app-config') return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/login') return true;
@@ -17,7 +17,7 @@ function isPublicApiPath(method: string, pathNoQuery: string): boolean {
 }
 
 /** Authenticated paths allowed while MFA is not yet enabled (setup + lockout recovery). */
-function isMfaSetupExemptPath(method: string, pathNoQuery: string): boolean {
+export function isMfaSetupExemptPath(method: string, pathNoQuery: string): boolean {
   if (method === 'GET' && pathNoQuery === '/api/auth/me') return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/mfa/setup') return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/mfa/enable') return true;