test: add dbtest.ResetDB helper that preserves admin user

Integration tests previously TRUNCATEd the users table at setup,
which wiped the operator's admin login every time the suite ran
against a Postgres instance shared with their dev environment.

This commit:

- Adds internal/dbtest/reset.go exposing ResetDB(t, pool) and
  TestUserPrefix. ResetDB truncates every data table EXCEPT users,
  then deletes only users whose username starts with TestUserPrefix.
- Migrates 9 test files (subsonic/scrobble, subsonic/star,
  recommendation/candidates, scrobble/queue, similarity/worker,
  playevents/writer, playsessions/service, api/auth, api/me) to
  call ResetDB instead of issuing TRUNCATE-with-users.
- Renames hardcoded test usernames to use TestUserPrefix so ResetDB
  cleans them between runs. seedUser in api/auth_test now prefixes
  internally; existing call sites pass bare names.
- Leaves auth/bootstrap_test.go alone — it legitimately tests
  first-time admin bootstrap and must wipe users.

Verified locally: full integration suite with -p 1 runs cleanly
under the existing MINSTREL_TEST_DATABASE_URL setup, and the admin
row in the shared dev DB survives the run.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/auth_test.go

@@ -21,6 +21,7 @@ import (
 	"git.fabledsword.com/bvandeusen/minstrel/internal/config"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/dbtest"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/playevents"
 )
 
@@ -45,10 +46,7 @@ func testHandlers(t *testing.T) (*handlers, *pgxpool.Pool) {
 		t.Fatalf("pool: %v", err)
 	}
 	t.Cleanup(pool.Close)
-	if _, err := pool.Exec(context.Background(),
-		"TRUNCATE play_events, skip_events, play_sessions, sessions, users RESTART IDENTITY CASCADE"); err != nil {
-		t.Fatalf("truncate: %v", err)
-	}
+	dbtest.ResetDB(t, pool)
 	w := playevents.NewWriter(pool, logger, 30*time.Minute, 0.5, 30000)
 	recCfg := config.RecommendationConfig{
 		BaseWeight: 1.0, LikeBoost: 2.0, RecencyWeight: 1.0,
@@ -60,16 +58,22 @@ func testHandlers(t *testing.T) (*handlers, *pgxpool.Pool) {
 	return h, pool
 }
 
+// seedUser creates a test user. The supplied username is automatically
+// prefixed with dbtest.TestUserPrefix so dbtest.ResetDB cleans it up
+// without touching the operator's admin row. Callers that need to send
+// the username in HTTP bodies or compare against API responses must
+// include the same prefix in their literals.
 func seedUser(t *testing.T, pool *pgxpool.Pool, username, password string, isAdmin bool) dbq.User {
 	t.Helper()
 	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.MinCost)
 	if err != nil {
 		t.Fatalf("bcrypt: %v", err)
 	}
+	prefixed := dbtest.TestUserPrefix + username
 	u, err := dbq.New(pool).CreateUser(context.Background(), dbq.CreateUserParams{
-		Username:     username,
+		Username:     prefixed,
 		PasswordHash: string(hash),
-		ApiToken:     "test-api-token-" + username,
+		ApiToken:     "test-api-token-" + prefixed,
 		IsAdmin:      isAdmin,
 	})
 	if err != nil {
@@ -82,7 +86,7 @@ func TestHandleLogin_SuccessSetsCookieAndReturnsToken(t *testing.T) {
 	h, pool := testHandlers(t)
 	seedUser(t, pool, "alice", "hunter2", false)
 
-	body := strings.NewReader(`{"username":"alice","password":"hunter2"}`)
+	body := strings.NewReader(`{"username":"test-alice","password":"hunter2"}`)
 	req := httptest.NewRequest(http.MethodPost, "/api/auth/login", body)
 	req.Header.Set("Content-Type", "application/json")
 	w := httptest.NewRecorder()
@@ -105,7 +109,7 @@ func TestHandleLogin_SuccessSetsCookieAndReturnsToken(t *testing.T) {
 	if resp.Token == "" {
 		t.Error("token empty")
 	}
-	if resp.User.Username != "alice" || resp.User.IsAdmin {
+	if resp.User.Username != "test-alice" || resp.User.IsAdmin {
 		t.Errorf("user = %+v, want alice/non-admin", resp.User)
 	}
 
@@ -133,7 +137,7 @@ func TestHandleLogin_WrongPasswordReturns401(t *testing.T) {
 	h, pool := testHandlers(t)
 	seedUser(t, pool, "alice", "hunter2", false)
 
-	body := strings.NewReader(`{"username":"alice","password":"wrong"}`)
+	body := strings.NewReader(`{"username":"test-alice","password":"wrong"}`)
 	req := httptest.NewRequest(http.MethodPost, "/api/auth/login", body)
 	req.Header.Set("Content-Type", "application/json")
 	w := httptest.NewRecorder()

internal/api/me_test.go

@@ -26,8 +26,8 @@ func TestHandleGetMe_ReturnsAuthenticatedUser(t *testing.T) {
 	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	if got.Username != "alice" || !got.IsAdmin {
-		t.Errorf("user = %+v, want alice/admin", got)
+	if got.Username != "test-alice" || !got.IsAdmin {
+		t.Errorf("user = %+v, want test-alice/admin", got)
 	}
 }