refactor(tests): introduce shared tests/common/ support module

Lift duplicated test-harness code (User factories, TestConfig builder,
login/CSRF flow, form/json helpers, case-directory seeding, URL path
builders) into `server/tests/common/` so future API changes touch one
file instead of every integration test.

Migrated batches: csrf_attack, auth, login, magic_link, security_headers
(28 tests); analyze, case_page, delete_recording, close_watermark,
retention_sweep (67 tests). All 95 tests still green.

Net line delta across these 10 files: +1113 / -1896 (~780 lines removed),
plus ~500 lines of new shared infrastructure under tests/common/.

server/tests/auth_test.rs

@@ -1,40 +1,22 @@
-use std::collections::HashMap;
-use std::sync::Arc;
+mod common;
 
 use axum::body::Body;
 use axum::http::{Request, StatusCode};
 use tower::util::ServiceExt;
 
-use doctate_server::config::{Config, User};
-
-fn test_config() -> Arc<Config> {
-    Arc::new(Config {
-        data_path: "/tmp/doctate-test".into(),
-        log_path: "/tmp/doctate-test/logs".into(),
-        users: vec![User {
-            slug: "dr_test".into(),
-            api_key: "test-key-123".into(),
-            web_password: "unused".into(),
-            role: "doctor".into(),
-            whisper: Default::default(),
-            retention: Default::default(),
-            window_hours: 72,
-            preview_lines: 2,
-        }],
-        api_keys: HashMap::from([("test-key-123".into(), "dr_test".into())]),
-        ..Config::test_default()
-    })
-}
+use common::{TestConfig, test_user};
 
 #[tokio::test]
 async fn valid_api_key_returns_user() {
-    let app = doctate_server::create_router(test_config());
+    let app = doctate_server::create_router(
+        TestConfig::new().with_user(test_user("dr_test")).build(),
+    );
 
     let response = app
         .oneshot(
             Request::builder()
                 .uri("/api/debug/whoami")
-                .header("X-API-Key", "test-key-123")
+                .header("X-API-Key", "key-dr_test")
                 .body(Body::empty())
                 .unwrap(),
         )
@@ -43,18 +25,16 @@ async fn valid_api_key_returns_user() {
 
     assert_eq!(response.status(), StatusCode::OK);
 
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .unwrap();
-    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
-
+    let json = common::body_json(response).await;
     assert_eq!(json["slug"], "dr_test");
     assert_eq!(json["role"], "doctor");
 }
 
 #[tokio::test]
 async fn invalid_api_key_returns_401() {
-    let app = doctate_server::create_router(test_config());
+    let app = doctate_server::create_router(
+        TestConfig::new().with_user(test_user("dr_test")).build(),
+    );
 
     let response = app
         .oneshot(
@@ -72,7 +52,9 @@ async fn invalid_api_key_returns_401() {
 
 #[tokio::test]
 async fn missing_api_key_returns_401() {
-    let app = doctate_server::create_router(test_config());
+    let app = doctate_server::create_router(
+        TestConfig::new().with_user(test_user("dr_test")).build(),
+    );
 
     let response = app
         .oneshot(