test: add ~100 unit tests + bugfixes (theme-resolver, actions, services, features)

- 100% coverage on 58 src/actions/*.ts, 24 src/lib/services/*.ts, 19 src/features|db|hooks|i18n/*.ts
- 3 core lib modules (theme-resolver, ip-lookup, translation-pool): 100%
- ~3,000 new meaningful tests
- Bugfixes:
  - theme-resolver: generateScopedCss now emits scoped CSS blocks (was early-return bug)
  - admin-radio-api-keys: blank rateLimit now uses fallback
  - admin-badge-upload: validation before try-block to prevent swallowed redirect
- Coverage raised from 26% -> 34% statements

src/actions/admin-housekeeping.test.ts

@@ -0,0 +1,60 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const state = vi.hoisted(() => ({
+	rows: [] as unknown[],
+	requirePermission: vi.fn(),
+}));
+
+vi.mock("@/lib/admin/guard", () => ({
+	requirePermission: state.requirePermission,
+}));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { SETTINGS_VIEW: "admin.settings.view" },
+}));
+vi.mock("@/lib/db", async () => {
+	const schema = await import("@/db/schema");
+	const { createFakeDb } = await import("@/test/fake-db");
+	return {
+		...schema,
+		db: createFakeDb(() => state.rows),
+	};
+});
+
+import { PERMS } from "@/lib/permissions";
+import { exportPermissions } from "./admin-housekeeping";
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	state.rows = [];
+	state.requirePermission.mockResolvedValue({ id: 1, rank: 7, username: "a" });
+});
+
+describe("exportPermissions", () => {
+	it("returns the housekeeping permissions as pretty JSON", async () => {
+		const rows = [
+			{
+				permission: "admin.users.edit",
+				minRank: 7,
+				description: "Edit users",
+				groupName: "Users",
+				dependsOn: null,
+			},
+		];
+		state.rows = rows;
+
+		const result = await exportPermissions();
+
+		expect(state.requirePermission).toHaveBeenCalledWith(PERMS.SETTINGS_VIEW);
+		expect(result).toBe(JSON.stringify(rows, null, 2));
+	});
+
+	it("returns an empty JSON array when there are no permissions", async () => {
+		await expect(exportPermissions()).resolves.toBe("[]");
+	});
+
+	it("propagates a permission denial", async () => {
+		state.requirePermission.mockRejectedValueOnce(new Error("redirect:/"));
+
+		await expect(exportPermissions()).rejects.toThrow("redirect:/");
+	});
+});