chore(quick-260613-ndv-01): add globalSetup for familysync_test isolation

- Create apps/api/test/global-setup.ts: root-provisions + grants + migrates
  familysync_test (local only); no-op when process.env.CI is truthy (T-ndv-04)
- Update apps/api/vitest.config.ts: wire globalSetup; add CI-gated test.env
  override (DB_NAME=familysync_test, DB_HOST) so workers never touch dev DB

apps/api/vitest.config.ts

@@ -1,14 +1,28 @@
 import { defineConfig } from 'vitest/config';
 
+// Under CI the job-level env already sets DB_NAME=familysync and DB_HOST=mariadb
+// (the ephemeral service container). Do not override those — CI provisions and
+// migrates its own DB via the db:migrate step (T-ndv-04).
+// Locally, force workers to connect to the isolated test DB so the dev
+// `familysync` DB is never mutated by the test suite (T-ndv-02).
+const isCI = !!process.env.CI;
+
 export default defineConfig({
   test: {
     environment: 'node',
     globals: true,
+    globalSetup: ['./test/global-setup.ts'],
     setupFiles: ['./test/setup.ts'],
     // Disable parallel file execution so concurrent DB tests do not interfere
     // via the shared MariaDB. The global afterEach in test/setup.ts truncates
     // list tables; running test files in parallel causes FK violations when one
     // file's afterEach deletes rows that another file's test is still using.
     fileParallelism: false,
+    env: isCI
+      ? {}
+      : {
+          DB_NAME: 'familysync_test',
+          DB_HOST: process.env.DB_HOST ?? '127.0.0.1',
+        },
   },
 });