test(05-01): add Wave-0 RED scaffolds + VAPID fixture + setup truncation

- tests/fixtures/vapid.ts: static TEST_VAPID keypair for offline unit tests
- tests/lib/pushDispatcher.test.ts: RED — 410/404 prune + 201/5xx no-delete
- tests/lib/pushCoalescer.test.ts: RED — burst coalesce fires once with count=N; excludeUserId
- tests/broker/reminderScheduler.test.ts: RED — shared+timed filter; dedup by (uid,minuteBucket)
- tests/lib/eventChangeDispatcher.test.ts: RED — create/meaningful-update fires; description-only silent; actor excluded
- tests/routes/push.test.ts: RED — POST 201/401; DELETE removes rows; GET vapid-public-key
- test/setup.ts: import pushSubscriptions + add db.delete(pushSubscriptions) in afterEach
- all 5 RED files fail on missing-module (correct; implementations in Plans 05-02..05-06)

apps/api/tests/fixtures/vapid.ts

@@ -0,0 +1,15 @@
+/**
+ * Static test VAPID keypair fixture.
+ *
+ * Used by unit tests that need a VAPID key triple without generating keys at
+ * runtime or touching the network. These are test-only values — they are NOT
+ * the production keys and must never be used outside tests.
+ *
+ * The keypair was generated once with `crypto.subtle.generateKey` (P-256/ECDH)
+ * and inlined here so tests are deterministic and offline-safe.
+ */
+export const TEST_VAPID = {
+  publicKey: 'BIr9cwAc5L5ZBuY6RazVpjZfIzaAAY_dXDvaMOgM8_nGO8HSyr-WsEoxsmvhG9hWJDK-Mn07rjAFnr9S8fa2w48',
+  privateKey: 'IjVM8QjjFqDI9_-lhJDmG9yhPpgcrEtKmM-GP1DLiyc',
+  subject: 'mailto:test@familysync.test',
+} as const