test: cover auth template migration

[manuelsampedro1]

Summary

/claim #71

Adds focused Vitest coverage for templates/auth/src/migration.sql by executing the migration in an in-memory SQLite database and asserting the behavior the auth template relies on:

• migration is idempotent and creates auth_users / auth_sessions
• users must have at least one identity field while username-only and email-only users are valid
• username/email uniqueness is case-insensitive and prevents cross-field collisions
• sessions enforce valid user_id ownership and unique session tokens

This is intentionally test-only and does not change production behavior.

Verification

• corepack pnpm exec vitest run templates/auth/src/migration.test.ts -> 4 tests passed
• corepack pnpm exec prettier --check templates/auth/src/migration.test.ts -> passed
• git diff --check -> passed

Baseline notes

• corepack pnpm test -- run currently fails in the existing RLS baseline: 4 failures in src/rls/index.test.ts where policy predicates are not added to SELECT/JOIN/subquery SQL.
• corepack pnpm exec tsc --noEmit --pretty false currently fails on existing type errors in plugins/cdc/index.test.ts, plugins/cdc/index.ts, src/cache/index.test.ts, src/do.test.ts, and src/operation.ts.

Transparency: AI-assisted with OpenAI Codex; I reviewed the diff and verified the focused test locally.