test(auth,payments,subs): add 58 unit tests for critical auth, payment, and subscription paths

Cover auth handlers (RegisterUser, LoginUser, RefreshToken), TokenService
(token rotation, reuse attack detection), payment callback edge cases
(duplicate/concurrent callbacks, multi-provider), subscription lifecycle
transitions (expire, pastDue, renew), and throttler proxy guard.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.env.test

@@ -0,0 +1,34 @@
+# =============================================================================
+# GoodGo Platform — Test Environment Variables
+# Used by E2E tests (Playwright globalSetup loads this automatically)
+# =============================================================================
+
+# Test database — separate from development DB for isolation
+DATABASE_URL=postgresql://goodgo:goodgo_secret@localhost:5432/goodgo_test?schema=public
+
+# Services (same as dev, adjust if your test infra differs)
+REDIS_URL=redis://localhost:6379
+TYPESENSE_HOST=localhost
+TYPESENSE_PORT=8108
+TYPESENSE_PROTOCOL=http
+TYPESENSE_API_KEY=ts_dev_key_change_me
+
+# MinIO
+MINIO_ENDPOINT=localhost
+MINIO_PORT=9000
+MINIO_ACCESS_KEY=minioadmin
+MINIO_SECRET_KEY=minioadmin_secret
+MINIO_BUCKET=goodgo-uploads
+
+# Auth (deterministic secrets for test reproducibility)
+JWT_SECRET=e2e-test-jwt-secret-key
+JWT_REFRESH_SECRET=e2e-test-refresh-secret-key
+JWT_EXPIRES_IN=15m
+JWT_REFRESH_EXPIRES_IN=7d
+NODE_ENV=test
+
+# Payment (sandbox)
+VNPAY_TMN_CODE=TESTCODE
+VNPAY_HASH_SECRET=TESTHASHSECRET
+VNPAY_URL=https://sandbox.vnpayment.vn/paymentv2/vpcpay.html
+VNPAY_RETURN_URL=http://localhost:3000/payment/return