feat(server): Express bootstrap, /health, ownerOnly on /api, smoke /api/spaces

tests/server.test.js

@@ -0,0 +1,40 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import request from 'supertest';
+import { createApp } from '../server.js';
+import { resetDb } from './helpers/db.js';
+import { migrateUp } from '../lib/db/migrate.js';
+
+let app;
+beforeAll(async () => {
+  await resetDb();
+  await migrateUp();
+  process.env.OWNER_TOKEN = 'test-token';
+  app = createApp();
+});
+
+describe('server', () => {
+  it('GET /health returns 200 with db_ok=true', async () => {
+    const res = await request(app).get('/health');
+    expect(res.status).toBe(200);
+    expect(res.body.db_ok).toBe(true);
+    expect(res.body.version).toBeDefined();
+  });
+
+  it('GET /api/spaces without token returns 401', async () => {
+    const res = await request(app).get('/api/spaces');
+    expect(res.status).toBe(401);
+  });
+
+  it('GET /api/spaces with token returns 200 and empty array', async () => {
+    const res = await request(app)
+      .get('/api/spaces')
+      .set('Authorization', 'Bearer test-token');
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual([]);
+  });
+
+  it('unknown route returns 404', async () => {
+    const res = await request(app).get('/api/nope').set('Authorization', 'Bearer test-token');
+    expect(res.status).toBe(404);
+  });
+});