feat: restructure test infrastructure with unit/integration/system separation

Test Organization:
- Create tests/unit/, tests/integration/, tests/system/ directories
- Move existing tests into appropriate categories
- Add pytest markers (@pytest.mark.unit, @pytest.mark.integration)

Shared Fixtures:
- Create conftest.py with SQLite engine (for unit tests)
- Add PostgreSQL session fixture with transaction rollback
- Add TestClient fixture for API tests

Configuration:
- Update pyproject.toml with asyncio_mode=auto
- Add test markers and default addopts
- Add aiosqlite dependency for SQLite support

E2E Testing:
- Initialize Playwright in e2e/ directory
- Add playwright.config.ts
- Create login flow E2E test

Build:
- Add test-unit, test-integration, test-system, test-e2e to Makefile
- Update test target to run all categories
- Add testing documentation to README

Note: Some tests have import issues due to missing python-jose
package in dev environment. This needs to be addressed separately.

apps/api/tests/unit/test_config.py

@@ -0,0 +1,73 @@
+import pytest
+
+from src.config import Settings
+from src.database import build_database_url
+
+
+n@pytest.mark.unit
+
+def test_settings_default_database_url_uses_asyncpg() -> None:
+    settings = Settings()
+
+    assert settings.database_url == "postgresql+asyncpg://headquarter:headquarter@postgres:5432/headquarter"
+
+
+n@pytest.mark.unit
+
+def test_build_database_url_uses_explicit_values() -> None:
+    url = build_database_url(
+        user="user",
+        password="pass",
+        host="db",
+        port=5433,
+        database="app",
+    )
+
+    assert url == "postgresql+asyncpg://user:pass@db:5433/app"
+
+
+n@pytest.mark.unit
+
+def test_settings_prefers_explicit_database_url_env(monkeypatch) -> None:
+    monkeypatch.setenv("DATABASE_URL", "postgresql+asyncpg://local:local@localhost:5432/localdb")
+
+    settings = Settings()
+
+    assert settings.database_url == "postgresql+asyncpg://local:local@localhost:5432/localdb"
+
+
+n@pytest.mark.unit
+
+def test_auth_settings_have_secure_defaults() -> None:
+    settings = Settings()
+
+    assert settings.authentik_client_id == "headquarter-web"
+    assert settings.authentik_client_secret == "change-me"
+    assert settings.resolved_authentik_authorize_url.endswith("/application/o/authorize/")
+    assert settings.resolved_authentik_token_url.endswith("/application/o/token/")
+    assert settings.resolved_authentik_jwks_url.endswith("/application/o/headquarter-web/jwks/")
+    assert settings.jwt_algorithm == "HS256"
+    assert settings.access_token_ttl_minutes == 15
+    assert settings.refresh_token_ttl_days == 7
+
+
+n@pytest.mark.unit
+
+def test_cookie_policy_is_strict_in_production(monkeypatch) -> None:
+    monkeypatch.setenv("APP_ENV", "production")
+
+    settings = Settings()
+
+    assert settings.cookie_secure is True
+    assert settings.cookie_samesite == "strict"
+
+
+n@pytest.mark.unit
+
+def test_cookie_policy_is_relaxed_for_local_dev(monkeypatch) -> None:
+    monkeypatch.setenv("APP_ENV", "development")
+
+    settings = Settings()
+
+    assert settings.cookie_secure is False
+    assert settings.cookie_samesite == "lax"

apps/api/tests/unit/test_migration_metadata.py

@@ -0,0 +1,41 @@
+import pytest
+
+from importlib.util import module_from_spec, spec_from_file_location
+from pathlib import Path
+
+
+n@pytest.mark.unit
+
+def test_initial_migration_defines_all_core_tables() -> None:
+    migration_path = Path(__file__).resolve().parents[1] / "alembic" / "versions" / "0001_initial_schema.py"
+    spec = spec_from_file_location("initial_schema", migration_path)
+
+    assert spec is not None
+    assert spec.loader is not None
+
+    module = module_from_spec(spec)
+    spec.loader.exec_module(module)
+
+    assert module.TABLE_NAMES == [
+        "users",
+        "ssh_keys",
+        "projects",
+        "git_repositories",
+        "user_configs",
+    ]
+
+
+n@pytest.mark.unit
+
+def test_refresh_tokens_migration_has_expected_revision_chain() -> None:
+    migration_path = Path(__file__).resolve().parents[1] / "alembic" / "versions" / "0002_refresh_tokens.py"
+    spec = spec_from_file_location("refresh_tokens", migration_path)
+
+    assert spec is not None
+    assert spec.loader is not None
+
+    module = module_from_spec(spec)
+    spec.loader.exec_module(module)
+
+    assert module.revision == "0002_refresh_tokens"
+    assert module.down_revision == "0001_initial_schema"