#21: run the tests that prove the auth fixes, in CI

ts-auth gains a Postgres service and migrations. The security regressions
this branch adds - wrong password, pass-the-hash, wrong TOTP code, lockout,
single-use recovery codes - are all decided in the database, so without one
they skip silently and CI would go green on an unauthenticated server.

webmail-build only ran "npm run build", so i18n.test.ts never executed
anywhere. It now lints and tests too, and the package gained the lint
script it was missing.

*.tsbuildinfo is ignored: tsc --noEmit leaves it behind and it is a local
build cache, not source.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -71,6 +71,20 @@ jobs:
   ts-auth:
     name: TypeScript (auth)
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: lambdamail_test
+          POSTGRES_USER: lambdamail_test
+          POSTGRES_PASSWORD: lambdamail_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
     defaults:
       run:
         working-directory: services/auth
@@ -78,9 +92,23 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with: { node-version: "20" }
+      # The auth suite asserts against real rows: password verification,
+      # lockout, TOTP replay and recovery-code consumption are all decided in
+      # the database, so a mock would prove nothing.
+      - name: Run migrations
+        run: |
+          docker run --rm --network host \
+            -v "$(pwd)/../../migrations:/migrations" \
+            migrate/migrate:v4.17.1 \
+            -path=/migrations \
+            -database "postgres://lambdamail_test:lambdamail_test@localhost:5432/lambdamail_test?sslmode=disable" \
+            up
       - run: npm install
       - run: npm run lint
       - run: npm test
+        env:
+          TEST_DATABASE_URL: postgres://lambdamail_test:lambdamail_test@localhost:5432/lambdamail_test?sslmode=disable
+          LAMBDAMAIL_MASTER_KEY: ci-master-key-at-least-16-chars
 
   ts-storage:
     name: TypeScript (storage)
@@ -107,6 +135,8 @@ jobs:
       - uses: actions/setup-node@v7
         with: { node-version: "20" }
       - run: npm install
+      - run: npm run lint
+      - run: npm test
       - run: npm run build
 
   security: