Add backend test harness with mock SQLite

GameList.Tests/AuthTests.cs

@@ -0,0 +1,50 @@
+using System.Net;
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using GameList.Tests.Support;
+
+namespace GameList.Tests;
+
+public class AuthTests
+{
+    [Fact]
+    public async Task Register_with_admin_key_sets_admin_flag()
+    {
+        using var factory = new TestWebApplicationFactory();
+        var client = factory.CreateClientWithCookies();
+
+        var response = await client.RegisterAsync("adminuser", admin: true);
+
+        response.EnsureSuccessStatusCode();
+        var json = await response.Content.ReadFromJsonAsync<JsonElement>();
+        Assert.True(json.GetProperty("IsAdmin").GetBoolean());
+    }
+
+    [Fact]
+    public async Task Register_duplicate_username_returns_conflict()
+    {
+        using var factory = new TestWebApplicationFactory();
+        var client = factory.CreateClientWithCookies();
+
+        var first = await client.RegisterAsync("duplicate");
+        first.EnsureSuccessStatusCode();
+
+        var second = await client.RegisterAsync("duplicate");
+
+        Assert.Equal(HttpStatusCode.Conflict, second.StatusCode);
+    }
+
+    [Fact]
+    public async Task Login_with_wrong_password_returns_unauthorized()
+    {
+        using var factory = new TestWebApplicationFactory();
+        var client = factory.CreateClientWithCookies();
+
+        await client.RegisterAsync("player1");
+
+        var login = await client.LoginAsync("player1", "wrongpass");
+
+        Assert.Equal(HttpStatusCode.Unauthorized, login.StatusCode);
+    }
+}