test(12-01): Wave-0 test scaffolds — setup.test.ts + user.test.ts (RED)
- Add apps/api/tests/routes/setup.test.ts with it.todo() scaffolds for:
SETUP-01 (GET /api/setup/status), SETUP-02 (validate/vapid + validate/oidc),
SETUP-01 (POST /api/setup/credential), SETUP-04 (POST /api/setup/complete
× 2 → first 200, second 423), D-10 effective-config 423 guard.
All 15 cases RED (it.todo) so Plan 02 implements against real failing tests.
- Extend apps/api/tests/auth/user.test.ts with D-08 first-login-claims describe
block (5 it.todo() cases): unclaimed user bind, is_admin preservation,
setup_complete=false fallthrough, no unclaimed fallthrough, no email lookup (D-10)
- Suite collects clean: 375 passed | 20 todo — no import errors
Lucas Berger
e098be3929