test(server): hermetic env defaults — tests no longer require local .env

config.ts requires JWT_SECRET at module-load time. Since `.env` is gitignored
it doesn't propagate to git worktrees, fresh clones, or CI without secrets —
producing 200+ confusing cascade failures (vitest module-mock errors that
look unrelated to the real cause).

Add a vitest setupFile that sets JWT_SECRET to a fixed test-only value via
`??=`, so a real .env still wins where one exists. Tests are now hermetic:
clone the repo, `pnpm install`, `pnpm --filter server test` → 477/477 pass.

packages/server/test/setup-env.ts

@@ -0,0 +1,7 @@
+// Vitest setup: provides test-only defaults for env vars that config.ts
+// requires at module-load time. Without this, every test that transitively
+// imports a server module aborts during import when .env is absent (fresh
+// worktrees, CI without secrets, contributor first-run). Real .env values
+// still take precedence — `??=` only fills holes.
+
+process.env.JWT_SECRET ??= 'test-only-jwt-secret-not-for-production-use!!';

packages/server/vitest.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    setupFiles: ['./test/setup-env.ts'],
+  },
+});