chore(quick-260613-ndv-02): clean-slate comment in setup.ts + README local-test docs

- Update apps/api/test/setup.ts header: clarify tests run against familysync_test
  (provisioned by global-setup.ts), document users-cleanup decision (intact across
  tests), and note CI-vs-local env difference
- Add apps/api/README.md "Running API tests locally" section: documents the test
  DB isolation, run command, DB_ROOT_PASSWORD requirement, and CI no-op behaviour
- Fix apps/api/test/global-setup.ts: switch from drizzle({ client, mode }) to
  drizzle(pool, { mode }) — drizzle-orm@0.45.2 isConfig() has a tautological OR
  in the `mode` branch that always returns false, causing the combined-config form
  to pass the config object as the client (client.query is not a function); two-arg
  form routes correctly; 244/244 tests pass against familysync_test

apps/api/test/global-setup.ts

@@ -80,23 +80,33 @@ export default async function setup(): Promise<void> {
   }
 
   // ── Step 4: Apply committed migrations to familysync_test ──────────────────
-  const appConn = await mysql.createConnection({
+  // Use a Pool (not a Connection) — drizzle-orm/mysql2 session.all() calls
+  // client.execute() and transaction() calls client.getConnection(), both of
+  // which are pool methods. createPool with connectionLimit:1 is the minimal form.
+  const appPool = mysql.createPool({
     host,
     port,
     user: appUser,
     password: appPassword,
     database: TEST_DB,
+    connectionLimit: 1,
     multipleStatements: true, // required by drizzle migrator for multi-statement SQL files
   });
 
   try {
-    const db = drizzle({ client: appConn, mode: 'default' });
+    // Pass pool as the first arg + config as the second. Do NOT use the
+    // { client: pool, mode } combined-config form — drizzle-orm@0.45.2 has a
+    // bug in isConfig() where the `mode` branch always returns false (its OR
+    // condition is a tautology), so the combined form falls through to
+    // construct({ client, mode }, undefined) and the session client becomes
+    // the plain config object (no .query()). The two-arg form is safe.
+    const db = drizzle(appPool, { mode: 'default' });
     const migrationsFolder = fileURLToPath(
       new URL('../src/db/migrations', import.meta.url),
     );
     await migrate(db, { migrationsFolder });
   } finally {
-    await appConn.end();
+    await appPool.end();
   }
 
   console.log('[global-setup] provisioned + migrated familysync_test');