tests: add coverage for src/actions/ (15 files) and src/lib/{admin,auth} (3 files)

- src/actions coverage: 2.4% -> 13.55%
- src/lib/admin coverage: 44.3% -> 84.81%
- src/lib/auth coverage: 90.52%
- vitest.config.ts: exclude .next.prev/ from test discovery

src/actions/admin-vpn.test.ts

@@ -0,0 +1,49 @@
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
+import { prisma } from "@/lib/prisma";
+import { siteSettings } from "@/lib/services/site-settings";
+import { logStaffActivity } from "@/lib/services/staff-activity";
+import { saveVpn } from "./admin-vpn";
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { SETTINGS_EDIT: "settings.edit" },
+}));
+vi.mock("@/lib/prisma", () => ({
+	prisma: { websiteSetting: { upsert: vi.fn() } },
+}));
+vi.mock("@/lib/services/site-settings", () => ({
+	siteSettings: { reload: vi.fn() },
+}));
+vi.mock("@/lib/services/staff-activity", () => ({ logStaffActivity: vi.fn() }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+vi.mock("next/navigation", () => ({ redirect: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string | null>) => ({
+	get: (key: string) => (key in data ? data[key] : null),
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue(staff as never);
+	vi.mocked(prisma.websiteSetting.upsert).mockResolvedValue({} as never);
+});
+
+describe("saveVpn", () => {
+	it("saves VPN settings and redirects", async () => {
+		await saveVpn(
+			fakeForm({
+				vpn_block_enabled: "1",
+				vpn_provider: "proxycheck",
+				vpn_api_key: "abc123",
+			}) as unknown as FormData,
+		);
+		expect(prisma.websiteSetting.upsert).toHaveBeenCalledTimes(4);
+		expect(siteSettings.reload).toHaveBeenCalled();
+		expect(redirect).toHaveBeenCalledWith("/admin/vpn?saved=1");
+	});
+});