tests: add coverage for src/actions/ (15 files) and src/lib/{admin,auth} (3 files)

- src/actions coverage: 2.4% -> 13.55%
- src/lib/admin coverage: 44.3% -> 84.81%
- src/lib/auth coverage: 90.52%
- vitest.config.ts: exclude .next.prev/ from test discovery

src/actions/admin-photos.test.ts

@@ -0,0 +1,37 @@
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
+import { prisma } from "@/lib/prisma";
+import { deletePhoto } from "./admin-photos";
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { PAGES_EDIT: "pages.edit" } }));
+vi.mock("@/lib/prisma", () => ({ prisma: { cameraWeb: { delete: vi.fn() } } }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const fakeForm = (data: Record<string, string>) => ({
+	get: (key: string) => data[key] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue({
+		id: 1,
+		rank: 7,
+		username: "admin",
+	} as never);
+});
+
+describe("deletePhoto", () => {
+	it("deletes a photo and revalidates", async () => {
+		await deletePhoto(fakeForm({ id: "42" }) as unknown as FormData);
+		expect(prisma.cameraWeb.delete).toHaveBeenCalledWith({ where: { id: 42 } });
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/photos");
+	});
+
+	it("returns early when id is not positive", async () => {
+		await deletePhoto(fakeForm({ id: "0" }) as unknown as FormData);
+		expect(prisma.cameraWeb.delete).not.toHaveBeenCalled();
+	});
+});