tests: add coverage for src/actions/ (15 files) and src/lib/{admin,auth} (3 files)

- src/actions coverage: 2.4% -> 13.55%
- src/lib/admin coverage: 44.3% -> 84.81%
- src/lib/auth coverage: 90.52%
- vitest.config.ts: exclude .next.prev/ from test discovery

src/actions/admin-alerts.test.ts

@@ -0,0 +1,41 @@
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
+import { rcon } from "@/lib/services/rcon";
+import { sendHotelAlert } from "./admin-alerts";
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { NOTIFICATIONS_EDIT: "notifications.edit" },
+}));
+vi.mock("@/lib/services/rcon", () => ({ rcon: { send: vi.fn() } }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const fakeForm = (data: Record<string, string>) => ({
+	get: (key: string) => data[key] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue({
+		id: 1,
+		rank: 7,
+		username: "admin",
+	} as never);
+});
+
+describe("sendHotelAlert", () => {
+	it("sends hotel alert and revalidates", async () => {
+		await sendHotelAlert(
+			fakeForm({ message: "Hello!" }) as unknown as FormData,
+		);
+		expect(rcon.send).toHaveBeenCalledWith("hotelalert", { message: "Hello!" });
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/alerts");
+	});
+
+	it("returns early when message is empty", async () => {
+		await sendHotelAlert(fakeForm({ message: "" }) as unknown as FormData);
+		expect(rcon.send).not.toHaveBeenCalled();
+	});
+});