refactor(tests): introduce shared tests/common/ support module

Lift duplicated test-harness code (User factories, TestConfig builder,
login/CSRF flow, form/json helpers, case-directory seeding, URL path
builders) into `server/tests/common/` so future API changes touch one
file instead of every integration test.

Migrated batches: csrf_attack, auth, login, magic_link, security_headers
(28 tests); analyze, case_page, delete_recording, close_watermark,
retention_sweep (67 tests). All 95 tests still green.

Net line delta across these 10 files: +1113 / -1896 (~780 lines removed),
plus ~500 lines of new shared infrastructure under tests/common/.

server/tests/case_page_test.rs

@@ -1,140 +1,19 @@
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
+mod common;
 
-use axum::body::Body;
-use axum::http::{Request, StatusCode, header};
-use doctate_common::oneliners::OnelinerState;
-use doctate_server::config::{Config, User};
+use axum::http::StatusCode;
 use tower::util::ServiceExt;
 
-fn unique_tmp(label: &str) -> PathBuf {
-    std::env::temp_dir().join(format!(
-        "doctate-case-page-{label}-{}-{}",
-        std::process::id(),
-        uuid::Uuid::new_v4()
-    ))
-}
+use doctate_common::oneliners::OnelinerState;
 
-fn make_user(slug: &str) -> User {
-    User {
-        slug: slug.into(),
-        api_key: format!("key-{slug}"),
-        web_password: bcrypt::hash("s", 4).unwrap(),
-        role: "doctor".into(),
-        whisper: Default::default(),
-        retention: Default::default(),
-        window_hours: 72,
-        preview_lines: 2,
-    }
-}
+use common::{
+    TestConfig, body_string, get_with_cookie, paths, seed_case, seed_oneliner_ready,
+    seed_oneliner_state, seed_recording, test_admin, test_user,
+};
 
-fn make_admin(slug: &str) -> User {
-    let mut u = make_user(slug);
-    u.role = "admin".into();
-    u
-}
-
-fn seed_oneliner(case_dir: &Path, text: &str) {
-    let state = OnelinerState::Ready {
-        text: text.to_owned(),
-        generated_at: "2026-04-18T10:00:00Z".into(),
-    };
-    let bytes = serde_json::to_vec(&state).unwrap();
-    std::fs::write(case_dir.join("oneliner.json"), bytes).unwrap();
-}
-
-fn seed_oneliner_state(case_dir: &Path, state: &OnelinerState) {
-    let bytes = serde_json::to_vec(state).unwrap();
-    std::fs::write(case_dir.join("oneliner.json"), bytes).unwrap();
-}
-
-fn config_with_llm_users(data_path: PathBuf, llm_url: String, users: Vec<User>) -> Arc<Config> {
-    let api_keys: HashMap<String, String> = users
-        .iter()
-        .map(|u| (u.api_key.clone(), u.slug.clone()))
-        .collect();
-    Arc::new(Config {
-        data_path,
-        users,
-        api_keys,
-        llm_url,
-        llm_api_key: "test-key".into(),
-        llm_model: "test-model".into(),
-        ..Config::test_default()
-    })
-}
-
-fn config_with_llm(data_path: PathBuf) -> Arc<Config> {
-    config_with_llm_users(data_path, "http://unused".into(), vec![make_user("dr_a")])
-}
-
-fn config_without_llm(data_path: PathBuf) -> Arc<Config> {
-    let users = vec![make_user("dr_a")];
-    let api_keys: HashMap<String, String> = users
-        .iter()
-        .map(|u| (u.api_key.clone(), u.slug.clone()))
-        .collect();
-    Arc::new(Config {
-        data_path,
-        users,
-        api_keys,
-        ..Config::test_default()
-    })
-}
-
-fn seed_case(data_path: &Path, slug: &str, case_id: &str) -> PathBuf {
-    let dir = data_path.join(slug).join(case_id);
-    std::fs::create_dir_all(&dir).unwrap();
-    dir
-}
-
-fn seed_recording(case_dir: &Path, ts_hms: &str, transcript: Option<&str>) {
-    let filename = format!("2026-04-15T{ts_hms}Z.m4a");
-    std::fs::write(case_dir.join(&filename), b"audio-bytes").unwrap();
-    if let Some(text) = transcript {
-        let tx_name = format!("2026-04-15T{ts_hms}Z.transcript.txt");
-        std::fs::write(case_dir.join(tx_name), text).unwrap();
-    }
-}
-
-async fn login(app: axum::Router, slug: &str) -> String {
-    let body = format!("slug={slug}&password=s");
-    let resp = app
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri("/web/login")
-                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
-                .body(Body::from(body))
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    for v in resp.headers().get_all(header::SET_COOKIE).iter() {
-        let s = v.to_str().unwrap();
-        if let Some(pair) = s.split(';').next()
-            && pair.starts_with("session=")
-        {
-            return pair.to_string();
-        }
-    }
-    panic!("no session cookie after login");
-}
-
-async fn body_string(resp: axum::response::Response) -> String {
-    let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
-        .await
-        .unwrap();
-    String::from_utf8(bytes.to_vec()).unwrap()
-}
-
-fn get_page(case_id: &str, cookie: &str, suffix: &str) -> Request<Body> {
-    Request::builder()
-        .uri(format!("/web/cases/{case_id}{suffix}"))
-        .header(header::COOKIE, cookie)
-        .body(Body::empty())
-        .unwrap()
+/// Password "s" is the shared test default; wrap `login` so call sites
+/// don't repeat the literal.
+async fn login_dr_a(app: &axum::Router) -> String {
+    common::login(app, "dr_a", "s").await
 }
 
 // ---------------------------------------------------------------------
@@ -143,36 +22,50 @@ fn get_page(case_id: &str, cookie: &str, suffix: &str) -> Request<Body> {
 
 #[tokio::test]
 async fn case_page_shows_document_when_present() {
-    let config = config_with_llm(unique_tmp("cp-doc"));
+    let cfg = TestConfig::new()
+        .with_label("cp-doc")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
     std::fs::write(case_dir.join("document.md"), "der Inhalt").unwrap();
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
     let body = body_string(resp).await;
 
     assert!(body.contains("der Inhalt"), "document body missing");
     assert!(
-        body.contains(&format!("/web/cases/{case_id}/recordings")),
+        body.contains(&paths::case_recordings(case_id)),
         "recordings sub-page link missing"
     );
 }
 
 #[tokio::test]
 async fn case_page_document_has_copy_button() {
-    let config = config_with_llm(unique_tmp("cp-copy"));
+    let cfg = TestConfig::new()
+        .with_label("cp-copy")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
     std::fs::write(case_dir.join("document.md"), "kopiere mich").unwrap();
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     assert!(body.contains(r#"id="copy-btn""#), "copy button missing");
@@ -184,19 +77,30 @@ async fn case_page_document_has_copy_button() {
 
 #[tokio::test]
 async fn case_page_shows_analyze_button_when_transcribed_without_document() {
-    let config = config_with_llm(unique_tmp("cp-analyze"));
+    let cfg = TestConfig::new()
+        .with_label("cp-analyze")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
-    seed_recording(&case_dir, "10-00-00", Some("transkribierter Text"));
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
+    seed_recording(
+        &case_dir,
+        "2026-04-15T10-00-00Z",
+        Some("transkribierter Text"),
+    );
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     assert!(
-        body.contains(&format!(r#"action="/web/cases/{case_id}/analyze""#)),
+        body.contains(&format!(r#"action="{}""#, paths::case_analyze(case_id))),
         "analyze form missing"
     );
     assert!(
@@ -207,15 +111,21 @@ async fn case_page_shows_analyze_button_when_transcribed_without_document() {
 
 #[tokio::test]
 async fn case_page_shows_llm_missing_hint_without_llm() {
-    let config = config_without_llm(unique_tmp("cp-llm"));
+    let cfg = TestConfig::new()
+        .with_label("cp-llm")
+        .with_user(test_user("dr_a"))
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
-    seed_recording(&case_dir, "10-00-00", Some("Text"));
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
+    seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some("Text"));
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     assert!(
@@ -226,14 +136,21 @@ async fn case_page_shows_llm_missing_hint_without_llm() {
 
 #[tokio::test]
 async fn case_page_empty_case_shows_placeholder() {
-    let config = config_with_llm(unique_tmp("cp-empty"));
+    let cfg = TestConfig::new()
+        .with_label("cp-empty")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    seed_case(&config.data_path, "dr_a", case_id);
+    seed_case(&cfg.data_path, "dr_a", case_id);
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
     let body = body_string(resp).await;
 
@@ -242,25 +159,31 @@ async fn case_page_empty_case_shows_placeholder() {
         "empty-case placeholder missing"
     );
     assert!(
-        body.contains(&format!(r#"action="/web/cases/{case_id}/close""#)),
+        body.contains(&format!(r#"action="{}""#, paths::case_close(case_id))),
         "close form missing on empty case"
     );
 }
 
 #[tokio::test]
 async fn case_page_foreign_user_returns_404() {
-    let data_path = unique_tmp("cp-idor");
-    let users = vec![make_user("dr_a"), make_user("dr_b")];
-    let config = config_with_llm_users(data_path, "http://unused".into(), users);
+    let cfg = TestConfig::new()
+        .with_label("cp-idor")
+        .with_user(test_user("dr_a"))
+        .with_user(test_user("dr_b"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "22222222-2222-2222-2222-222222222222";
     // Case exists under dr_b, but session is dr_a → 404.
-    let case_dir = seed_case(&config.data_path, "dr_b", case_id);
+    let case_dir = seed_case(&cfg.data_path, "dr_b", case_id);
     std::fs::write(case_dir.join("document.md"), "fremdes Dokument").unwrap();
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     assert_eq!(resp.status(), StatusCode::NOT_FOUND);
 }
 
@@ -270,17 +193,21 @@ async fn case_page_foreign_user_returns_404() {
 
 #[tokio::test]
 async fn case_recordings_shows_all_recordings() {
-    let config = config_with_llm(unique_tmp("rec-list"));
+    let cfg = TestConfig::new()
+        .with_label("rec-list")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
-    seed_recording(&case_dir, "10-00-00", Some("erste Aufnahme"));
-    seed_recording(&case_dir, "11-00-00", None);
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
+    seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some("erste Aufnahme"));
+    seed_recording(&case_dir, "2026-04-15T11-00-00Z", None);
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
     let resp = app
-        .oneshot(get_page(case_id, &cookie, "/recordings"))
+        .oneshot(get_with_cookie(paths::case_recordings(case_id), &cookie))
         .await
         .unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
@@ -294,38 +221,49 @@ async fn case_recordings_shows_all_recordings() {
 
 #[tokio::test]
 async fn case_recordings_back_link_targets_case_page() {
-    let config = config_with_llm(unique_tmp("rec-back"));
+    let cfg = TestConfig::new()
+        .with_label("rec-back")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
-    seed_recording(&case_dir, "10-00-00", None);
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
+    seed_recording(&case_dir, "2026-04-15T10-00-00Z", None);
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
     let resp = app
-        .oneshot(get_page(case_id, &cookie, "/recordings"))
+        .oneshot(get_with_cookie(paths::case_recordings(case_id), &cookie))
         .await
         .unwrap();
     let body = body_string(resp).await;
 
     assert!(
-        body.contains(&format!(r#"href="/web/cases/{case_id}""#)),
+        body.contains(&format!(r#"href="{}""#, paths::case_detail(case_id))),
         "back link must target the case page, not /web/cases"
     );
 }
 
 #[tokio::test]
 async fn case_page_uses_oneliner_as_h1_when_present() {
-    let config = config_with_llm(unique_tmp("cp-h1"));
+    let cfg = TestConfig::new()
+        .with_label("cp-h1")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
-    seed_oneliner(&case_dir, "Herzkatheter unauffällig");
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
+    seed_oneliner_ready(&case_dir, "Herzkatheter unauffällig");
     std::fs::write(case_dir.join("document.md"), "Inhalt").unwrap();
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     // H1 wraps the oneliner; the short case_id fallback must be gone.
@@ -349,13 +287,15 @@ async fn case_page_uses_oneliner_as_h1_when_present() {
 /// cases stuck on "generiere Titel …" forever.
 #[tokio::test]
 async fn case_page_silent_only_shows_empty_not_generating() {
-    let config = config_with_llm(unique_tmp("cp-silent"));
+    let cfg = TestConfig::new()
+        .with_label("cp-silent")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "33333333-3333-3333-3333-333333333333";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
-    // `Some("")` produces a 0-byte transcript sidecar — the whisper-as-
-    // silence output. Combined with `OnelinerState::Empty`, this is the
-    // terminal shape of a silent-only case after the fix.
-    seed_recording(&case_dir, "10-00-00", Some(""));
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
+    // Some("") → 0-byte transcript sidecar — whisper-as-silence output.
+    seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some(""));
     seed_oneliner_state(
         &case_dir,
         &OnelinerState::Empty {
@@ -363,10 +303,13 @@ async fn case_page_silent_only_shows_empty_not_generating() {
         },
     );
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     assert!(
@@ -384,9 +327,13 @@ async fn case_page_falls_back_to_generic_title_for_empty_state() {
     // An `Empty` state (LLM deliberately returned no medical content) is
     // not a text; the H1 must fall back to the generic "Fall" label, not
     // leak the kind string or crash the template.
-    let config = config_with_llm(unique_tmp("cp-empty"));
+    let cfg = TestConfig::new()
+        .with_label("cp-empty-gen")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "22222222-2222-2222-2222-222222222222";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
     seed_oneliner_state(
         &case_dir,
         &OnelinerState::Empty {
@@ -394,10 +341,13 @@ async fn case_page_falls_back_to_generic_title_for_empty_state() {
         },
     );
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     assert!(body.contains("Fall"), "expected generic 'Fall' fallback");
@@ -409,16 +359,21 @@ async fn case_page_falls_back_to_generic_title_for_empty_state() {
 
 #[tokio::test]
 async fn case_page_admin_sees_admin_view_toggle() {
-    let data_path = unique_tmp("cp-toggle");
-    let users = vec![make_admin("dr_admin")];
-    let config = config_with_llm_users(data_path, "http://unused".into(), users);
+    let cfg = TestConfig::new()
+        .with_label("cp-toggle")
+        .with_user(test_admin("dr_admin"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    seed_case(&config.data_path, "dr_admin", case_id);
+    seed_case(&cfg.data_path, "dr_admin", case_id);
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_admin").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = common::login(&app, "dr_admin", "s").await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     assert!(
@@ -429,14 +384,21 @@ async fn case_page_admin_sees_admin_view_toggle() {
 
 #[tokio::test]
 async fn case_page_non_admin_has_no_admin_view_toggle() {
-    let config = config_with_llm(unique_tmp("cp-no-toggle"));
+    let cfg = TestConfig::new()
+        .with_label("cp-no-toggle")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    seed_case(&config.data_path, "dr_a", case_id);
+    seed_case(&cfg.data_path, "dr_a", case_id);
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     assert!(
@@ -447,16 +409,21 @@ async fn case_page_non_admin_has_no_admin_view_toggle() {
 
 #[tokio::test]
 async fn case_page_admin_sees_full_case_id_meta() {
-    let data_path = unique_tmp("cp-admin");
-    let users = vec![make_admin("dr_admin")];
-    let config = config_with_llm_users(data_path, "http://unused".into(), users);
+    let cfg = TestConfig::new()
+        .with_label("cp-admin")
+        .with_user(test_admin("dr_admin"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    seed_case(&config.data_path, "dr_admin", case_id);
+    seed_case(&cfg.data_path, "dr_admin", case_id);
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_admin").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = common::login(&app, "dr_admin", "s").await;
 
-    let resp = app.oneshot(get_page(case_id, &cookie, "")).await.unwrap();
+    let resp = app
+        .oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
+        .await
+        .unwrap();
     let body = body_string(resp).await;
 
     assert!(
@@ -467,28 +434,32 @@ async fn case_page_admin_sees_full_case_id_meta() {
 
 #[tokio::test]
 async fn case_recordings_breadcrumb_includes_oneliner() {
-    let config = config_with_llm(unique_tmp("rec-breadcrumb"));
+    let cfg = TestConfig::new()
+        .with_label("rec-breadcrumb")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
-    seed_oneliner(&case_dir, "Kurzer Befund");
-    seed_recording(&case_dir, "10-00-00", None);
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
+    seed_oneliner_ready(&case_dir, "Kurzer Befund");
+    seed_recording(&case_dir, "2026-04-15T10-00-00Z", None);
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
     let resp = app
-        .oneshot(get_page(case_id, &cookie, "/recordings"))
+        .oneshot(get_with_cookie(paths::case_recordings(case_id), &cookie))
         .await
         .unwrap();
     let body = body_string(resp).await;
 
     // Two separate breadcrumb links: back to the case list and back to the case page.
     assert!(
-        body.contains(r#"href="/web/cases""#),
+        body.contains(&format!(r#"href="{}""#, paths::CASES)),
         "breadcrumb must link back to the case list"
     );
     assert!(
-        body.contains(&format!(r#"href="/web/cases/{case_id}""#)),
+        body.contains(&format!(r#"href="{}""#, paths::case_detail(case_id))),
         "breadcrumb must link back to the case page"
     );
     assert!(
@@ -499,26 +470,30 @@ async fn case_recordings_breadcrumb_includes_oneliner() {
 
 #[tokio::test]
 async fn case_recordings_has_no_action_buttons() {
-    let config = config_with_llm(unique_tmp("rec-ro"));
+    let cfg = TestConfig::new()
+        .with_label("rec-ro")
+        .with_user(test_user("dr_a"))
+        .with_llm("http://unused")
+        .build();
     let case_id = "11111111-1111-1111-1111-111111111111";
-    let case_dir = seed_case(&config.data_path, "dr_a", case_id);
-    seed_recording(&case_dir, "10-00-00", Some("Text"));
+    let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
+    seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some("Text"));
 
-    let app = doctate_server::create_router(config);
-    let cookie = login(app.clone(), "dr_a").await;
+    let app = doctate_server::create_router(cfg);
+    let cookie = login_dr_a(&app).await;
 
     let resp = app
-        .oneshot(get_page(case_id, &cookie, "/recordings"))
+        .oneshot(get_with_cookie(paths::case_recordings(case_id), &cookie))
         .await
         .unwrap();
     let body = body_string(resp).await;
 
     assert!(
-        !body.contains(&format!(r#"action="/web/cases/{case_id}/analyze""#)),
+        !body.contains(&format!(r#"action="{}""#, paths::case_analyze(case_id))),
         "recordings page must not expose the analyze action"
     );
     assert!(
-        !body.contains(&format!(r#"action="/web/cases/{case_id}/close""#)),
+        !body.contains(&format!(r#"action="{}""#, paths::case_close(case_id))),
         "recordings page must not expose the close action"
     );
 }