feat: add test database setup and teardown for end-to-end tests, ensuring unique and non-ephemeral ports

Makefile

@@ -1,4 +1,4 @@
-.PHONY: up down logs test lint migrate-up migrate-down gen-dev-cert seed preflight create-admin reset-password reset-mfa
+.PHONY: up down logs test test-db-up test-db-down lint migrate-up migrate-down gen-dev-cert seed preflight create-admin reset-password reset-mfa
 
 # Local development builds from source; production pulls what CI published.
 up:
@@ -10,12 +10,45 @@ down:
 logs:
 	docker compose logs -f
 
+# TEST_DATABASE_URL is what decides whether the suites that assert against
+# real rows actually run. Without it the Go postgres tests t.Skip and the auth
+# suite skips 35 of its 72 - and both report success, so "make test" can print
+# a clean run while the tests that would have caught a schema change never
+# executed. That is not hypothetical: a folder added to createMailbox passed
+# here and failed in CI, which does set the variable.
 test:
+	@if [ -z "$$TEST_DATABASE_URL" ]; then 		echo "=============================================================="; 		echo "TEST_DATABASE_URL is not set."; 		echo "The database-backed tests will SKIP, and the suites will still"; 		echo "report success. CI sets it, so a green run here does not mean"; 		echo "a green run there. Start one with:"; 		echo "  make test-db-up"; 		echo "=============================================================="; 	fi
 	cd services/protocols && go test ./...
 	cd services/auth && npm test
 	cd services/storage && npm test
 	cd services/webmail && npm test
 
+# Brings up a throwaway Postgres with every migration applied, and prints the
+# URL to export. Matches what CI provisions, so "make test" with this exported
+# runs the same set of tests CI does.
+test-db-up:
+	docker rm -f lambdamail-test-db 2>/dev/null || true
+	docker run -d --name lambdamail-test-db \
+		-e POSTGRES_USER=lambdamail_test \
+		-e POSTGRES_PASSWORD=lambdamail_test \
+		-e POSTGRES_DB=lambdamail_test \
+		-p 55432:5432 postgres:16-alpine
+	@# pg_isready alone is not enough: the postgres entrypoint brings the
+	@# server up once to run its init scripts and then restarts it, so there is
+	@# a window where it answers ready and then drops the connection. A real
+	@# query is what proves it is actually serving.
+	@until docker exec lambdamail-test-db psql -U lambdamail_test -d lambdamail_test -c "SELECT 1" >/dev/null 2>&1; do sleep 1; done
+	docker run --rm --network host -v "$(PWD)/migrations:/migrations" \
+		migrate/migrate:v4.17.1 -path=/migrations \
+		-database "postgres://lambdamail_test:lambdamail_test@localhost:55432/lambdamail_test?sslmode=disable" up
+	@echo ""
+	@echo "Ready. Export this, then run make test:"
+	@echo "  export TEST_DATABASE_URL='postgres://lambdamail_test:lambdamail_test@localhost:55432/lambdamail_test?sslmode=disable'"
+	@echo "  export LAMBDAMAIL_MASTER_KEY='local-master-key-at-least-16-chars'"
+
+test-db-down:
+	docker rm -f lambdamail-test-db 2>/dev/null || true
+
 lint:
 	cd services/protocols && go vet ./...
 	node scripts/lang-lint.mjs