test: add functional regression tests for IDOR fixes (Phase 4)

- Add @japa/api-client devDependency (was missing despite being required
  for the 'client' fixture used in functional tests)
- Wire up sessionApiClient/authApiClient/shieldApiClient plugins in
  tests/bootstrap.ts so tests can authenticate (loginAs) and pass CSRF
  validation (withCsrfToken)
- Wrap each functional test in a global DB transaction (withGlobalTransaction)
  for isolation and rollback
- Add .env.test with SESSION_DRIVER=memory: the cookie session driver used
  in dev/prod is incompatible with Japa's session test client, which needs
  a store it can read/write by session id
- tests/functional/computers.spec.ts: covers owner can update; a user
  cannot update/delete another user's computer (404); a user cannot
  attach another user's component via componentsId (404); two components
  of the same unique type cannot be attached (422); deleting a computer
  detaches its components instead of destroying them
- tests/functional/components.spec.ts: covers owner can update; a user
  cannot update/delete another user's component (404); an unauthenticated
  request cannot delete a component (redirects to /auth/login)

All 10 tests pass, exercising the security fixes from commit 3cc189c.

tests/bootstrap.ts

@@ -1,9 +1,13 @@
 import { assert } from '@japa/assert'
+import { apiClient } from '@japa/api-client'
 import app from '@adonisjs/core/services/app'
 import type { Config } from '@japa/runner/types'
 import { pluginAdonisJS } from '@japa/plugin-adonisjs'
 import { dbAssertions } from '@adonisjs/lucid/plugins/db'
 import testUtils from '@adonisjs/core/services/test_utils'
+import { authApiClient } from '@adonisjs/auth/plugins/api_client'
+import { sessionApiClient } from '@adonisjs/session/plugins/api_client'
+import { shieldApiClient } from '@adonisjs/shield/plugins/api_client'
 
 /**
  * This file is imported by the "bin/test.ts" entrypoint file
@@ -13,7 +17,15 @@ import testUtils from '@adonisjs/core/services/test_utils'
  * Configure Japa plugins in the plugins array.
  * Learn more - https://japa.dev/docs/runner-config#plugins-optional
  */
-export const plugins: Config['plugins'] = [assert(), pluginAdonisJS(app), dbAssertions(app)]
+export const plugins: Config['plugins'] = [
+  assert(),
+  apiClient(),
+  sessionApiClient(app),
+  authApiClient(app),
+  shieldApiClient(),
+  pluginAdonisJS(app),
+  dbAssertions(app),
+]
 
 /**
  * Configure lifecycle function to run before and after all the
@@ -33,6 +45,9 @@ export const runnerHooks: Required<Pick<Config, 'setup' | 'teardown'>> = {
  */
 export const configureSuite: Config['configureSuite'] = (suite) => {
   if (['browser', 'functional', 'e2e'].includes(suite.name)) {
-    return suite.setup(() => testUtils.httpServer().start())
+    suite.setup(() => testUtils.httpServer().start())
+    suite.onGroup((group) => {
+      group.each.setup(() => testUtils.db().withGlobalTransaction())
+    })
   }
 }