test: add test utilities and mock infrastructure

[jakebromberg]

Closes #246

Summary

Lay the foundation for the test suite by adding shared infrastructure that all subsequent test PRs depend on:

• lib/test-utils/component-harness.ts — Redux-wrapped hook rendering harness (createHookWrapper) so hook tests get a real store without boilerplate
• lib/test-utils/fixtures.ts — Test data factories and shared MOCK_USERS for consistent test identities
• lib/test-utils/index.ts — Barrel export for clean imports
• Auth and bin-api mocks — Reusable mock setup for organization-utils, organization-config, and utilities
• e2e/fixtures/auth.fixture.ts — Playwright-style login/logout helpers with port discovery for e2e tests

Test plan

• Run test suite to verify utilities work

Part 1 of 26 — Test infrastructure. Merge before all other test PRs.

Note: E2E tests depend on #271 and WXYC/Backend-Service#223. E2E will pass once those merge.

Note: Merge this PR before #148 — both modify lib/test-utils/fixtures.ts.

[cloudflare-workers-and-pages]

Deploying wxyc-dj with    Cloudflare Pages

Latest commit:	f760520
Status:	✅  Deploy successful!
Preview URL:	https://196f8edc.dj-site.pages.dev
Branch Preview URL:	https://test-01-test-utilities.dj-site.pages.dev

View logs

[JacksonMeade]

The testing infrastructure is extremely clean, I'm a big fan.

There are several places where (I assume, since I never write comments like this) the AI has, in my opinion, over-commented the code, adding unnecessary commentary that could easily become outdated as the codebase drifts.

Hidden in this PR, however, is the total removal of the organization client, a feature of the design that I wish had been made explicit. This is a huge change to the way roles work, and not a decision we have discussed. That is blocking for me until it is justified.

[JacksonMeade]

What is the purpose of this replacement? I worry that this is either an artifact of errors while mocking the backend or performing some of the work that now resides in next.config.mjs:

/** @type {import('next').NextConfig} */
const authBaseURL = process.env.NEXT_PUBLIC_BETTER_AUTH_URL || "https://api.wxyc.org/auth";

const nextConfig = {
  reactStrictMode: false,
  // Explicitly set workspace root to silence lockfile warning
  outputFileTracingRoot: import.meta.dirname,
  // Required for OpenNext Cloudflare
  output: "standalone",
  async rewrites() {
    return [
      {
        source: "/auth/:path*",
        destination: `${authBaseURL}/:path*`,
      },
    ];
  },
};

export default nextConfig;

// OpenNext Cloudflare dev initialization
import { initOpenNextCloudflareForDev } from "@opennextjs/cloudflare";
initOpenNextCloudflareForDev();

[jakebromberg]

Addressed all points in the latest force push:

1. Organization removal -- Reverted. The org plugin is fully restored; client.ts, server-client.ts, and organization-utils.ts all match main again. The org removal was tracking a change in wxyc-shared (47ad9fb6), but since that's also on a feature branch and not merged, I've pulled it out of this PR entirely. We can discuss the org architecture separately.

2. Over-commenting -- Removed the vi.mock hoisting notes and verbose @example blocks from bin-api.ts and auth.ts. Comments are now single-line summaries.

3. Port-finding -- Replaced the hardcoded port array with a PORT_RANGE_START/PORT_RANGE_SIZE loop. The function now throws if all ports are exhausted instead of silently defaulting.

4. URL replacement -- Added a comment explaining why /auth is stripped: the env var includes the path (e.g., http://localhost:8084/auth), but the fixture needs the bare host for direct HTTP calls to the auth service, bypassing Next.js rewrites.

5. SES emails -- Opened Prevent SES email sending during test runs #178 to track preventing email sends during test runs.

6. Sign-out endpoint -- Replaced expireUserSession with revokeUserSessions, which calls /auth/revoke-sessions with a session cookie. Added a doc reference to better-auth's session management docs.

7. Mock users -- Consolidated into a single MOCK_USERS constant in lib/test-utils/fixtures.ts. Both the e2e fixture and unit test mocks now reference it.

8. Org mock -- No longer confusing since the org plugin is restored. The organization.getFullOrganization / listMembers mocks correctly reflect the client API.

9. Auth hooks -- The changes to authenticationHooks.ts were part of the org removal commit, which has been reverted. The file now matches main.