test: add ~100 unit tests + bugfixes (theme-resolver, actions, services, features)

- 100% coverage on 58 src/actions/*.ts, 24 src/lib/services/*.ts, 19 src/features|db|hooks|i18n/*.ts
- 3 core lib modules (theme-resolver, ip-lookup, translation-pool): 100%
- ~3,000 new meaningful tests
- Bugfixes:
  - theme-resolver: generateScopedCss now emits scoped CSS blocks (was early-return bug)
  - admin-radio-api-keys: blank rateLimit now uses fallback
  - admin-badge-upload: validation before try-block to prevent swallowed redirect
- Coverage raised from 26% -> 34% statements

src/test/fake-db.ts

@@ -0,0 +1,63 @@
+import type { SQL } from "drizzle-orm";
+
+/**
+ * Test helper for mocking the Drizzle query builder without a database.
+ *
+ * Usage inside a `vi.mock("@/lib/db", ...)` factory:
+ *
+ * ```ts
+ * vi.mock("@/lib/db", async () => {
+ *   const schema = await import("@/db/schema");
+ *   const { createFakeDb } = await import("@/test/fake-db");
+ *   return {
+ *     ...schema,
+ *     db: createFakeDb((table) => (table === schema.User ? users : [])),
+ *   };
+ * });
+ * ```
+ *
+ * `resolve` receives the table object passed to `.from(...)` and the select
+ * projection (so callers can detect `count()` queries via a `total` key).
+ */
+export type FakeDbResolver = (
+	table: unknown,
+	projection: Record<string, unknown>,
+) => unknown[] | Promise<unknown[]>;
+
+function makeQuery(
+	table: unknown,
+	projection: Record<string, unknown>,
+	resolve: FakeDbResolver,
+) {
+	const query: Record<string, unknown> = {};
+	const self = () => query;
+	for (const method of [
+		"where",
+		"orderBy",
+		"limit",
+		"offset",
+		"leftJoin",
+		"innerJoin",
+		"groupBy",
+		"having",
+		"for",
+	]) {
+		query[method] = self;
+	}
+	query.then = (
+		onFulfilled: (value: unknown) => unknown,
+		onRejected: (error: unknown) => unknown,
+	) => Promise.resolve(resolve(table, projection)).then(onFulfilled, onRejected);
+	query.catch = (onRejected: (error: unknown) => unknown) =>
+		Promise.resolve(resolve(table, projection)).catch(onRejected);
+	return query;
+}
+
+export function createFakeDb(resolve: FakeDbResolver) {
+	return {
+		select: (projection: Record<string, unknown> = {}) => ({
+			from: (table: unknown) => makeQuery(table, projection, resolve),
+		}),
+		execute: (query: SQL | string) => resolve(query, {}),
+	};
+}