feat: add integration tests against real database (#1247)

[ogunjobielijah09-cyber]

• Create docker-compose.test.yml for isolated test Postgres (port 5433) and Redis (port 6380)
• Add integration test setup with migration runner, database cleanup, and test isolation
• Create test helpers for factory functions (users, tips, refunds, withdrawals, challenges)
• Add comprehensive integration tests for auth flow: challenge creation, user registration with unique constraints, concurrent user creation, refresh token lifecycle, cascade deletes
• Add integration tests for tips: txHash unique constraint, concurrent creation with P2002 handling, user relations, status transitions, queries, refund relationships
• Add integration tests for refunds: tipId unique constraint, concurrent requests with P2002 (validates Add a unique constraint audit and fix duplicate-write races #1249 fix), refund-tip relationships, status transitions, cascade deletes
• Add integration tests for withdrawals: txHash unique constraint, concurrent submission, user relationships, status transitions, balance calculations
• Add npm scripts: test:integration, test:integration:watch, test:db:up, test:db:down, test:db:reset
• Create vitest.integration.config.ts for integration test configuration
• Apply migrations at test suite start to verify schema validity
• Document two-layer testing strategy in README.md with usage guide

Note: GitHub Actions workflow will be added separately due to token scope requirements

Closes #1247

Description

Closes #

Type of Change

Please mark the options that are relevant:

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 🧪 Tests (adding new tests or updating existing tests)
• 📝 Documentation (changes to documentation/configs only)
• 🚀 DevOps & CI/CD (changes to workflows, scripts, or templates)

Changes Made

How to Test

Checklist

💻 Smart Contract Changes (if applicable)

• Running cargo fmt -- --check passes successfully.
• Running cargo clippy -- -D warnings runs without any warnings.
• All tests pass successfully using cargo test.
• New unit or integration tests have been written to cover the changes.
• No hardcoded values are present (e.g. addresses, fees) that should be configurable.

🎨 Frontend Changes (if applicable)

• TypeScript compiles cleanly with no errors (npm run typecheck or npx tsc --noEmit).
• Running npm run lint shows no linting errors.
• The production build compiles successfully via npm run build.
• Changes verified on local browser environment with Freighter/xBull/Albedo wallet.
• Responsive design verified (tested on mobile, tablet, and desktop viewport sizes).
• Keyboard navigation and accessibility (a11y) considerations are addressed.

⚙️ General

• Code follows the project's coding standards and structure guidelines.
• Self-reviewed the changes to ensure clean code with no commented-out code blocks.
• No console.log or debug code remains in production files.
• The branch is up-to-date with the main branch.

Screenshots / Demos (if applicable)

[drips-wave]

@ogunjobielijah09-cyber Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
-	-	Generic Password	0b1841b	backend/docker-compose.test.yml	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}