test(05-01): add Wave-0 RED scaffolds + VAPID fixture + setup truncation

- tests/fixtures/vapid.ts: static TEST_VAPID keypair for offline unit tests
- tests/lib/pushDispatcher.test.ts: RED — 410/404 prune + 201/5xx no-delete
- tests/lib/pushCoalescer.test.ts: RED — burst coalesce fires once with count=N; excludeUserId
- tests/broker/reminderScheduler.test.ts: RED — shared+timed filter; dedup by (uid,minuteBucket)
- tests/lib/eventChangeDispatcher.test.ts: RED — create/meaningful-update fires; description-only silent; actor excluded
- tests/routes/push.test.ts: RED — POST 201/401; DELETE removes rows; GET vapid-public-key
- test/setup.ts: import pushSubscriptions + add db.delete(pushSubscriptions) in afterEach
- all 5 RED files fail on missing-module (correct; implementations in Plans 05-02..05-06)

apps/api/tests/lib/pushDispatcher.test.ts

@@ -0,0 +1,96 @@
+/**
+ * RED scaffold — pushDispatcher (Plan 05-02 turns this GREEN).
+ *
+ * Asserts that dispatchPush:
+ *   - Deletes the push_subscriptions row when the push service returns 410 (Gone)
+ *   - Deletes the push_subscriptions row when the push service returns 404 (Not Found)
+ *   - Does NOT delete the row on 201 (success)
+ *   - Does NOT delete the row on transient 5xx errors
+ *
+ * These tests fail now because pushDispatcher.ts does not yet exist.
+ * Run: pnpm --filter @familysync/api exec vitest run tests/lib/pushDispatcher.test.ts
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { PushSubscription } from '../../src/lib/pushDispatcher.js'
+
+// Mock web-push so no real network calls occur
+vi.mock('web-push', () => ({
+  default: {
+    sendNotification: vi.fn(),
+    setVapidDetails: vi.fn(),
+  },
+}))
+
+// Mock the DB module so we can assert on deletes without a real database
+vi.mock('../../src/db/client.js', () => ({
+  db: {
+    delete: vi.fn().mockReturnValue({
+      where: vi.fn().mockResolvedValue(undefined),
+    }),
+  },
+}))
+
+const FAKE_SUB: PushSubscription = {
+  id: 1,
+  userId: 42,
+  endpoint: 'https://push.example.com/sub/abc',
+  p256dh: 'fake_p256dh',
+  auth: 'fake_auth',
+}
+
+describe('pushDispatcher — 410/404 subscription pruning', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('deletes the subscription row when the push service returns 410 (Gone)', async () => {
+    const webpush = (await import('web-push')).default
+    const { db } = await import('../../src/db/client.js')
+    vi.mocked(webpush.sendNotification).mockRejectedValueOnce(
+      Object.assign(new Error('Gone'), { statusCode: 410 }),
+    )
+
+    const { dispatchPush } = await import('../../src/lib/pushDispatcher.js')
+    await dispatchPush(FAKE_SUB, { title: 'Test', body: 'Hello' })
+
+    expect(vi.mocked(db.delete)).toHaveBeenCalled()
+  })
+
+  it('deletes the subscription row when the push service returns 404 (Not Found)', async () => {
+    const webpush = (await import('web-push')).default
+    const { db } = await import('../../src/db/client.js')
+    vi.mocked(webpush.sendNotification).mockRejectedValueOnce(
+      Object.assign(new Error('Not Found'), { statusCode: 404 }),
+    )
+
+    const { dispatchPush } = await import('../../src/lib/pushDispatcher.js')
+    await dispatchPush(FAKE_SUB, { title: 'Test', body: 'Hello' })
+
+    expect(vi.mocked(db.delete)).toHaveBeenCalled()
+  })
+
+  it('does NOT delete the row on 201 success', async () => {
+    const webpush = (await import('web-push')).default
+    const { db } = await import('../../src/db/client.js')
+    vi.mocked(webpush.sendNotification).mockResolvedValueOnce({ statusCode: 201, body: '', headers: {} })
+
+    const { dispatchPush } = await import('../../src/lib/pushDispatcher.js')
+    await dispatchPush(FAKE_SUB, { title: 'Test', body: 'Hello' })
+
+    expect(vi.mocked(db.delete)).not.toHaveBeenCalled()
+  })
+
+  it('does NOT delete the row on transient 5xx error', async () => {
+    const webpush = (await import('web-push')).default
+    const { db } = await import('../../src/db/client.js')
+    vi.mocked(webpush.sendNotification).mockRejectedValueOnce(
+      Object.assign(new Error('Service Unavailable'), { statusCode: 503 }),
+    )
+
+    const { dispatchPush } = await import('../../src/lib/pushDispatcher.js')
+    await dispatchPush(FAKE_SUB, { title: 'Test', body: 'Hello' })
+
+    expect(vi.mocked(db.delete)).not.toHaveBeenCalled()
+  })
+})