test: run infra and module tests against real postgres/redis

[zaxovaiko]

Summary

Rewrites the infra-layer and module test suites to run against real Postgres and Redis instead of in-process fakes and vi-mocked Drizzle chains. Mock-choreography assertions (call counts on query builders) are replaced with outcome assertions on real rows, which lets the suite prove behaviors mocks structurally cannot: unique-index dedupe, FOR UPDATE locking under concurrency, atomic conditional updates, and real read-through cache invalidation. Whole-suite cost: 528 -> 535 tests, ~7.7s -> ~9-11s.

Changes

• packages/core/src/testing/real-infra.ts (new, exported from @openora/core/testing): createTestDb(migrations) - ephemeral per-file database + per-module migrations, dropped WITH (FORCE); createTestRedis() - per-vitest-worker logical Redis DB (VITEST_POOL_ID % 16) so parallel workers never share keys. Fails fast with an actionable message when infra is down.
• server/kernel/__tests__ - all Redis drivers (RedisCache, RedisRateLimiter, RedisStreamsBroker, BullMqJobQueue), EventBus, and the cached/assertRateLimit prod helpers now run on live Redis. New multi-instance broker test: two brokers with the same service name -> exactly one handles an event (competing consumers); different names -> both.
• iam.service.test.ts (41 -> 44): drops vi.mock('drizzle-orm') entirely; real concurrency proofs for LastSuperAdminError (FOR UPDATE), acceptInvitation replay-safety, assignRole unique-index dedupe; grant-cache read-through + invalidateUser/invalidateRole purge on live Redis.
• chat.service.test.ts - message persistence, display-name resolution, and per-viewer block filtering on real SQL; realtime-push seam keeps its designated test double.
• cms.reads.test.ts, lobby.cache.test.ts - true read-through cache tests (TTL asserted via PTTL, staleness-after-direct-DB-write actually observed).
• identity.rate-limit.test.ts, wallet.rate-limit.test.ts - RedisRateLimiter on live Redis; DB stays mocked (only limiter behavior is asserted).
• docker-compose.yml - redis service ungated (starts by default).
• .github/workflows/ci.yml - verify job gets health-checked postgres + redis service containers.

Checklist

• pnpm verify is green (typecheck + lint + boundaries + module-shape + tests)
• pnpm verify:drift is green (catalog / OpenAPI not stale) - test-only change, no contract/schema edits
• New cross-module talk goes through events / command ports / contracts / the /schema subpath (no direct module imports)
• New data tables carry tenantId and are RLS-covered - n/a, no new tables
• No secrets, real player data, or internal/customer names added
• Docs / AGENTS.md updated if behavior or extension points changed - n/a, no behavior change

Notes

• Stacked on refactor: distributed-only production - remove in-process seams from the prod path #15 (distributed-only seams) - the harness and driver tests depend on @openora/core/testing fakes relocation and RedisStreamsBroker; retarget to dev after refactor: distributed-only production - remove in-process seams from the prod path #15 merges.
• pnpm test:unit now requires docker compose up -d locally (postgres + redis). CI provides both as service containers.
• Deliberately still on fakes/mocks: fail-open/fail-closed branches (a healthy backend cannot fail on demand), the realtime-push seam in chat (no prod driver yet), testing/fakes themselves (used by bootTestApp), and pure-logic tests that never touch a backend.