test: vitest + supertest harness with regression pin for #3

[CryptoJones]

Closes #31.

Stacked on top of #33 (hygiene) and #34 (env config + relicense). Merge those
first or this diff will look slightly noisier against master.

Summary

Adds a hermetic HTTP smoke-test suite for the two existing endpoints, plus a
regression pin for #3 (the missing-auth bug on /v1/customer/bycompany/:id).

Coverage

Endpoint	Test	Note
GET /v1/customer/:id	403 when authKey is missing	Hits the controller's first-line short-circuit; no DB touched.
GET /v1/customer/:id	Route mounts and resolves (not 404)	Basic wiring check.
GET /v1/customer/bycompany/:id	Route mounts and resolves (not 404)	Basic wiring check.
GET /v1/customer/bycompany/:id	#3 regression pin — 403 when authKey missing	Uses test.fails. See below.

How the regression pin works

Today, getAllByCompanyId has zero auth check — requests reach the database query path before any header inspection. The pin asserts the correct future behavior (expect(res.status).toBe(403)) wrapped in test.fails, so:

• While Broken Authentication in GET endpoint /v1/customer/bycompany/# #3 is open: the assertion correctly fails → test.fails succeeds → the suite stays green.
• Once Broken Authentication in GET endpoint /v1/customer/bycompany/# #3 is fixed: the controller will short-circuit on missing authKey (mirroring getCustomerById), so the assertion will pass → test.fails itself fails ("expected failure didn't happen"), prompting whoever applied the fix to flip the wrapper to plain test(...).

That gives us a self-documenting tripwire for the auth bug without requiring it be fixed first.

Tooling

• vitest ^4.1.6 + supertest ^7.2.2 added as devDependencies only.
• npm test runs once (CI-mode); npm run test:watch reruns on file changes.
• No live database needed. The suite stubs app/config/db.config.js via vi.mock; some controller paths that use sequelize.query() directly will still attempt a real connection in CJS-require chains (vi.mock hoisting is finicky with mixed CJS), but every assertion in this suite is written to be correct regardless of whether the mock takes full effect.

Local verification

$ npm test
 ✓ tests/api/customer.test.js (2 tests)
 ✓ tests/api/customer-bycompany.test.js (2 tests)
 Test Files  2 passed (2)
      Tests  3 passed | 1 expected fail (4)

Acceptance criteria from #31

• npm test runs and exits 0 on a healthy checkout.
• At least 4 distinct test cases across the two existing endpoints.
• One regression test pinned to the behavior fix from Broken Authentication in GET endpoint /v1/customer/bycompany/# #3.

Follow-ups (not in scope)

• A separate PR could improve the mock chain so the integration paths (getCustomerById master-key flow) become fully testable in isolation.
• An integration suite that runs against a containerized Postgres would be a useful CI add — different runner, different ticket.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/