feat: add web testing foundation with infra-backed suites (#349)

* feat: add web test framework with infra-backed suites

* fix: honor DATABASE_URL env in integration prepare script

* fix: apply web test review feedback

* fix: streamline web test infra lifecycle and workflow scope

apps/web/src/app/api/health/route.api.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { GET } from "~/app/api/health/route";
+
+describe("health route", () => {
+  it("returns healthy response", async () => {
+    const response = await GET();
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ data: "Healthy" });
+  });
+});

apps/web/src/app/api/webhook/stripe/route.api.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it, vi } from "vitest";
+
+const { state } = vi.hoisted(() => ({
+  state: {
+    signature: null as string | null,
+  },
+}));
+
+vi.mock("next/headers", () => ({
+  headers: vi.fn(async () => {
+    const headers = new Headers();
+    if (state.signature) {
+      headers.set("Stripe-Signature", state.signature);
+    }
+    return headers;
+  }),
+}));
+
+vi.mock("~/server/billing/payments", () => ({
+  getStripe: vi.fn(() => ({
+    webhooks: {
+      constructEvent: vi.fn(),
+    },
+  })),
+  syncStripeData: vi.fn(),
+}));
+
+import { POST } from "~/app/api/webhook/stripe/route";
+
+describe("stripe webhook route", () => {
+  it("returns 400 when signature header is missing", async () => {
+    state.signature = null;
+
+    const response = await POST(
+      new Request("http://localhost", { method: "POST" }),
+    );
+
+    expect(response.status).toBe(400);
+    await expect(response.text()).resolves.toBe("No signature");
+  });
+
+  it("returns 400 when webhook secret is not configured", async () => {
+    state.signature = "test-signature";
+
+    const response = await POST(
+      new Request("http://localhost", {
+        method: "POST",
+        body: "{}",
+      }),
+    );
+
+    expect(response.status).toBe(400);
+    await expect(response.text()).resolves.toBe("No webhook secret");
+  });
+});