test(integration): DB-backed harness validating shipped SQL (045/042/044/043)

Root-cause fix for 'correctness depended on post-deploy manual audits'.
Separate psql-driven suite (pnpm test:integration, own vitest config,
integration/ outside __tests__ so the hermetic pnpm test gate is
untouched; self-skips without a DB). 18 tests run against real Postgres:
- 045 class_signup_tx/class_cancel_tx: RETURNS TABLE->array shape the
  actions destructure, capacity/waitlist/dedupe, and the per-session
  advisory lock under TWO concurrent connections (D11 proven, never
  over-enrolls).
- 042 equipment exclusion constraint (overlap 23P01; cancelled/adjacent
  ok). 044 self-change trigger (role + payment cols blocked; service
  bypass). 043 members_update WITH CHECK (cross-space move blocked).
Disproves the pass-52 flagged risk (signup rpc-shape). Non-runtime;
default pnpm test still 532/26 hermetic; build clean.

vitest.integration.config.ts

@@ -0,0 +1,22 @@
+import { defineConfig } from 'vitest/config'
+import path from 'path'
+
+// Integration suite: runs the shipped SQL (RPCs / constraints / RLS /
+// triggers) against a REAL Postgres via psql. Deliberately separate from the
+// default `pnpm test` (which stays hermetic, jsdom, no DB) and from the
+// `__tests__/` include glob, so `pnpm test` never touches a database.
+// Run with: pnpm test:integration  (prereq: a reachable Postgres, default
+// the Supabase-CLI local stack — see docs/LOCAL_DEV.md). Self-skips cleanly
+// when no DB is reachable, so it never blocks contributors/CI without one.
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: 'node',
+    include: ['integration/**/*.test.ts'],
+    testTimeout: 30000,
+    hookTimeout: 30000,
+  },
+  resolve: {
+    alias: { '@': path.resolve(__dirname, './') },
+  },
+})