test(05-01): add Wave-0 RED scaffolds + VAPID fixture + setup truncation

- tests/fixtures/vapid.ts: static TEST_VAPID keypair for offline unit tests
- tests/lib/pushDispatcher.test.ts: RED — 410/404 prune + 201/5xx no-delete
- tests/lib/pushCoalescer.test.ts: RED — burst coalesce fires once with count=N; excludeUserId
- tests/broker/reminderScheduler.test.ts: RED — shared+timed filter; dedup by (uid,minuteBucket)
- tests/lib/eventChangeDispatcher.test.ts: RED — create/meaningful-update fires; description-only silent; actor excluded
- tests/routes/push.test.ts: RED — POST 201/401; DELETE removes rows; GET vapid-public-key
- test/setup.ts: import pushSubscriptions + add db.delete(pushSubscriptions) in afterEach
- all 5 RED files fail on missing-module (correct; implementations in Plans 05-02..05-06)

apps/api/test/setup.ts

@@ -17,11 +17,12 @@
 
 import { afterEach } from 'vitest'
 import { db } from '../src/db/client.js'
-import { lists, listItems, listShares } from '../src/db/schema.js'
+import { lists, listItems, listShares, pushSubscriptions } from '../src/db/schema.js'
 
 /**
- * Truncate list tables in FK-safe order after each test.
+ * Truncate list and push tables in FK-safe order after each test.
  * list_items and list_shares have FK to lists; delete children first.
+ * pushSubscriptions has FK to users via user_id; deleted before lists (no FK to lists).
  * Called automatically via afterEach — no per-test setup needed.
  */
 afterEach(async () => {
@@ -29,6 +30,7 @@ afterEach(async () => {
     // Delete child rows first to avoid FK constraint violations
     await db.delete(listItems)
     await db.delete(listShares)
+    await db.delete(pushSubscriptions)
     await db.delete(lists)
   } catch {
     // DB may not be available in pure-unit test runs (no DB_HOST configured).