refactor(tests): introduce shared tests/common/ support module

Lift duplicated test-harness code (User factories, TestConfig builder,
login/CSRF flow, form/json helpers, case-directory seeding, URL path
builders) into `server/tests/common/` so future API changes touch one
file instead of every integration test.

Migrated batches: csrf_attack, auth, login, magic_link, security_headers
(28 tests); analyze, case_page, delete_recording, close_watermark,
retention_sweep (67 tests). All 95 tests still green.

Net line delta across these 10 files: +1113 / -1896 (~780 lines removed),
plus ~500 lines of new shared infrastructure under tests/common/.

server/tests/common/mod.rs

@@ -0,0 +1,40 @@
+//! Shared test-support helpers for `server/tests/*.rs`.
+//!
+//! Every integration test file under `tests/*.rs` is a standalone crate.
+//! This module's special filename `mod.rs` prevents Cargo from
+//! compiling it as its own test target — it is only loaded by test
+//! files that opt in via `mod common;` at the top.
+//!
+//! `#[allow(dead_code)]` is applied because each test crate uses only
+//! a subset of the helpers; without the allow, rustc emits a forest of
+//! warnings for the unused ones in each crate.
+
+#![allow(dead_code)]
+// Re-exports below are visible to every test crate, but each crate only
+// uses a subset — without the allow, rustc emits "unused import"
+// warnings per crate. The helpers themselves are exercised; the
+// warning is a false positive of the per-crate visibility model.
+#![allow(unused_imports)]
+
+pub mod config;
+pub mod http;
+pub mod paths;
+pub mod seed;
+pub mod session;
+pub mod users;
+
+// Re-exports for ergonomic `use common::*;` in most test files.
+pub use config::{TestConfig, unique_tmpdir};
+pub use http::{
+    body_json, body_string, csrf_form_post, form_post, get_with_api_key,
+    get_with_api_key_if_none_match, get_with_cookie, header_opt, header_str, multipart_upload_body,
+};
+pub use seed::{
+    past_rfc3339, seed_case, seed_oneliner_ready, seed_oneliner_state, seed_recording,
+    seed_recording_with_age, seed_recording_with_sidecars, write_closed_marker,
+};
+pub use session::{extract_session_cookie, login, login_request, login_with_csrf};
+pub use users::{
+    TEST_BCRYPT_COST, TEST_PASSWORD, test_admin, test_user, test_user_with_password,
+    test_user_with_retention, test_user_with_window_hours,
+};