test(helpers): add db, fetch, app, and auth test helpers

withTestDb sets up an in-memory SQLite handle with migrations
applied, swaps the production singleton via _setDbForTest, and
restores in a finally block. installFetchStub captures every
outbound request and throws if restored twice. requestApp wraps
Oak's app.handle so route tests can run without listen().
stubAuthenticate flips the server's authenticator indirection.

tests/_helpers/db.ts

@@ -0,0 +1,60 @@
+import { Database } from "@db/sqlite";
+import {
+  _resetDbForTest,
+  _setDbForTest,
+  addWebhookSubscription,
+  upsertNote,
+  type WebhookVerb,
+} from "../../src/data/db.ts";
+import { applyMigrations } from "../../src/migrations/apply.ts";
+import type { Note } from "../../src/data/note.ts";
+
+export const withTestDb = (
+  fn: (db: Database) => Promise<void> | void,
+): () => Promise<void> => {
+  return async () => {
+    const db = new Database(":memory:");
+    applyMigrations(db);
+    _setDbForTest(db);
+    try {
+      await fn(db);
+    } finally {
+      _resetDbForTest();
+      db.close();
+    }
+  };
+};
+
+let seedCounter = 0;
+
+export const seedNote = (overrides: Partial<Note> = {}): Note => {
+  seedCounter++;
+  const note: Note = {
+    did: overrides.did ?? "did:plc:test",
+    rkey: overrides.rkey ?? `seed${seedCounter.toString().padStart(6, "0")}`,
+    title: overrides.title ?? "Test title",
+    publishedAt: overrides.publishedAt ?? "2026-01-01T00:00:00.000Z",
+    createdAt: overrides.createdAt ?? "2026-01-01T00:00:00.000Z",
+    discoverable: overrides.discoverable,
+    language: overrides.language,
+    content: overrides.content,
+  };
+  upsertNote(note);
+  return note;
+};
+
+export const seedWebhook = (overrides: {
+  did?: string;
+  method?: string;
+  url?: string;
+  token?: string;
+  verb?: WebhookVerb;
+} = {}) => {
+  return addWebhookSubscription({
+    did: overrides.did ?? "did:plc:test",
+    method: overrides.method ?? "POST",
+    url: overrides.url ?? "https://example.com/hook",
+    token: overrides.token,
+    verb: overrides.verb ?? "create",
+  });
+};