test: add functional regression tests for IDOR fixes (Phase 4)

- Add @japa/api-client devDependency (was missing despite being required
  for the 'client' fixture used in functional tests)
- Wire up sessionApiClient/authApiClient/shieldApiClient plugins in
  tests/bootstrap.ts so tests can authenticate (loginAs) and pass CSRF
  validation (withCsrfToken)
- Wrap each functional test in a global DB transaction (withGlobalTransaction)
  for isolation and rollback
- Add .env.test with SESSION_DRIVER=memory: the cookie session driver used
  in dev/prod is incompatible with Japa's session test client, which needs
  a store it can read/write by session id
- tests/functional/computers.spec.ts: covers owner can update; a user
  cannot update/delete another user's computer (404); a user cannot
  attach another user's component via componentsId (404); two components
  of the same unique type cannot be attached (422); deleting a computer
  detaches its components instead of destroying them
- tests/functional/components.spec.ts: covers owner can update; a user
  cannot update/delete another user's component (404); an unauthenticated
  request cannot delete a component (redirects to /auth/login)

All 10 tests pass, exercising the security fixes from commit 3cc189c.

package.json

@@ -42,6 +42,7 @@
     "@adonisjs/eslint-config": "^3.1.0",
     "@adonisjs/prettier-config": "^1.5.0",
     "@adonisjs/tsconfig": "^2.0.0",
+    "@japa/api-client": "^3.2.1",
     "@japa/assert": "^4.2.0",
     "@japa/browser-client": "^2.3.0",
     "@japa/plugin-adonisjs": "^5.2.0",