Add e2e tests for me.* procedures and fix code review issues

- Add comprehensive e2e tests for me.get, me.authStatus, me.setupProfile,
  me.updateProfile, me.setPassword, and me.delete (21 tests)
- Make createDb require explicit connection string (no default env lookup)
- Add database name validation to prevent SQL injection in CREATE DATABASE
- Fix getTestDatabaseUrl to throw instead of returning empty string
- Replace brittle relative path with findRepoRoot() function
- Extract magic numbers (SESSION_EXPIRY_MS, API_TOKEN_EXPIRY_MS, ONE_DAY_MS)
- Consolidate duplicate createAPIContext functions
- Add hasPassword field to meAuthStatus and toUserResponse

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

packages/db/src/client.ts

@@ -13,16 +13,13 @@ const { Pool } = pg;
 /**
  * Creates a new Kysely database client
  *
- * @param connectionString - PostgreSQL connection string (defaults to DATABASE_URL env var)
+ * @param connectionString - PostgreSQL connection string (required)
  * @returns Kysely database instance
+ * @throws Error if connectionString is empty
  */
-export const createDb = (
-  connectionString: string = Bun.env.DATABASE_URL ?? "",
-): Kysely<Database> => {
+export const createDb = (connectionString: string): Kysely<Database> => {
   if (!connectionString) {
-    throw new Error(
-      "Database connection string is required. Set DATABASE_URL environment variable.",
-    );
+    throw new Error("Database connection string is required");
   }
 
   const dialect = new PostgresDialect({

packages/db/src/index.ts

@@ -5,7 +5,7 @@
  *
  * Usage:
  *   import { createDb } from "@reviq/db";
- *   const db = createDb();  // Uses DATABASE_URL env var
+ *   const db = createDb(process.env.DATABASE_URL);  // Requires connection URL
  *   // ... use db ...
  *   await db.destroy();
  */