test(backend): add comprehensive integration and stress test suite for Idempotency Key Manager

[Abidoyesimze]

Summary

Closes #1466

Depends on #1607 (the Idempotency Key Manager locking rewrite). This branch is stacked on #1607's branch, so until #1607 merges the diff below also shows that commit — after #1607 merges this PR auto-retargets to main and shrinks to just the test suite. These tests exercise the locking behaviour added there, so they cannot pass against main as-is.

Adds the integration and stress suite for the Idempotency Key Manager, which had none: the middleware's correctness properties (exactly-once execution, replay identity, conflict semantics, lock expiry, TTL behaviour) were previously only argued about, never executed.

New shared test double src/lib/__testing__/fake-redis.js — an in-memory Redis with the exact command surface the middleware uses (SET with NX/PX, GET, DEL, EVALSHA/Lua script semantics, TTL expiry with an injectable clock), so tests are deterministic and run without a Redis container. The existing unit tests were refactored to import this same double instead of defining their own.

New suite src/lib/idempotency.integration.test.js:

• Concurrency: N concurrent requests with the same key under a slow handler → handler executes exactly once; the others get 409. Different keys run in parallel.
• Replay: identical method/path/body → stored status + body + Idempotency-Replayed header, handler not re-executed. Mutated body → mismatch rejection. Missing/changed key material → not treated as a replay.
• Crash recovery: lock TTL expiry lets a new request re-acquire; a holder that dies before completion doesn't wedge the key forever; Lua CAS mismatch is counted as an orphaned completion.
• Stress: a few hundred mixed operations (creates, replays, conflicts) against the fake — total executions equal the number of distinct keys, zero orphaned locks, counters end in the expected state.
• Real Redis suite (opt-in): same properties run against a live Redis when REDIS_URL is set; skipped by default (describe.skipIf) so CI without Redis stays green.

Test plan

npx vitest run src/lib/idempotency.test.js src/lib/idempotency.integration.test.js
 Test Files  2 passed (2)
      Tests  22 passed | 1 skipped (23)

(the 1 skip is the real-Redis suite, gated on REDIS_URL)

Full backend suite: no new failures vs. origin/main (identical pre-existing failure count).

Security notes

• The fake Redis lives under src/lib/__testing__/ and is only imported by tests; nothing in the runtime import graph pulls it in.
• No real credentials are used or required; the real-Redis suite reads REDIS_URL from the environment like the application does.
• Stress tests assert bounded key counts and no leaked locks, so a regression that leaks Redis keys (a slow memory-growth vector under key-guessing traffic) fails the suite.

[vercel]

@Abidoyesimze is attempting to deploy a commit to the Emmanuel's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Abidoyesimze Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits