Tests: vollständige Suite auch mit RLS_ENFORCED=true grün

- test-tenant-isolation: Compound-Key mit fremdem Mandanten – im Owner-Betrieb Throw
  (Tenant-Guard), unter scharfer RLS liefert die DB null; beides = kein Datenabfluss
- run-tests.ts: lädt .env und leitet RLS_DATABASE_URL (Rolle craftvia_app) aus
  DATABASE_URL ab, wenn RLS_ENFORCED=true und keine URL gesetzt ist

Nachweis: RLS_ENFORCED=true npm run test → 52/52; npm run gate → 52/52.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/run-tests.ts

@@ -8,6 +8,7 @@
  * Lauf:  npm run test                  (alle)
  *        npm run test -- mail tenant   (nur Tests, deren Name einen der Filter enthält)
  */
+import "dotenv/config";
 import { spawnSync } from "node:child_process";
 import { readdirSync } from "node:fs";
 import { join, dirname } from "node:path";
@@ -26,6 +27,15 @@ if (tests.length === 0) {
   process.exit(1);
 }
 
+// RLS runs (RLS_ENFORCED=true): db.ts refuses to start without RLS_DATABASE_URL. Default it to the
+// same database as DATABASE_URL with the restricted role (as scripts/test-rls-enforcement.ts does).
+if (process.env.RLS_ENFORCED === "true" && !process.env.RLS_DATABASE_URL && process.env.DATABASE_URL) {
+  const url = new URL(process.env.DATABASE_URL);
+  url.username = "craftvia_app";
+  url.password = "craftvia_app_local";
+  process.env.RLS_DATABASE_URL = url.toString();
+}
+
 const results: { name: string; ok: boolean; ms: number }[] = [];
 for (const file of tests) {
   const started = Date.now();