Repository contract tests per port (ADR-064) #712

Tracking issue for ADR-064 (Proposed): test layers follow the hexagon, with repository contract tests per port.

#710 removes the global in-memory MongoDB from core's unit setup and adds the *.db.test.js / npm run test:db path. A db CI job runs that path against MongoDB 8 (replica set) and PostgreSQL 16. This issue covers moving every repository port onto one shared contract suite, run against each adapter.

Per port

For each port:

• write one contract suite;
• run it against the MongoDB and PostgreSQL adapters (the DocumentDB adapter runs on MongoDB in CI);
• include the encryption extension where the port stores encrypted fields;
• delete the Prisma-mocking adapter tests the suite replaces.

First, where encryption and tenancy live:

• credential
• integration
• module (entities)
• user
• token

Then:

• integration-mapping (seed: the existing *-query-parity suite)
• process
• sync
• usage
• websocket-connection
• health-check
• artifact
• admin-script-execution
• script-schedule

Also

• In-memory fake repositories for use-case tests (one per port, built against the same contract)
• Tenant-isolation PostgreSQL suite joins the db job when the Management API v2 / ownership stack lands
• Documented manual contract run against a real DocumentDB cluster before each release