Migrate the API to native ESM and vitest; pin Node 26

Prep PR for the admin auth module (docs/plan-admin-auth.md step 1).
better-auth 1.7 ships ESM only, so the API moves off CommonJS:

- "type": "module", module nodenext, target ES2024, .js suffixes on all
  relative imports, require('mariadb'|'cors') replaced by imports, and
  export= packages (winston, app-root-path, bcrypt) consumed via default
  imports. The logger now uses appRoot.path explicitly.
- TypeScript 5.9, @types/node 26, tslint removed. Node 26 pinned via
  engines and .nvmrc (Plesk runs 26).
- Jest 28 + ts-jest replaced by vitest 5. Eight test files depend on
  hoisted module mocks with static imports and resetModules + require,
  which Jest's ESM mode does not support; vitest keeps them nearly
  verbatim. Coverage via @vitest/coverage-v8 (lcov), Sonar generic report
  via vitest-sonar-reporter, so sonar-project.properties is unchanged.
  vitest.config.ts sets FEEDBACK_IP_SALT so the suite passes without a
  local .env.
- dotenv 8 -> 16 and axios 0.24 -> 1.x: their old typings are not
  resolvable under nodenext.
- autoCommit: false dropped from the pool configs; it is not a mariadb
  connector option and was silently ignored.

tsc clean, 96/96 tests green, compiled app boots and serves /, /docs and
CORS under Node ESM.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

test/common/common.mail.test.ts

@@ -5,17 +5,18 @@
 // behaviour, and that a delivery failure is swallowed (returns false, never
 // throws).
 
-jest.mock('../../src/common/salesforce.client');
-jest.mock('../../src/middleware/logger', () => ({
+import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
+vi.mock('../../src/common/salesforce.client.js');
+vi.mock('../../src/middleware/logger.js', () => ({
 	__esModule: true,
-	default: {info: jest.fn(), warn: jest.fn(), error: jest.fn()}
+	default: {info: vi.fn(), warn: vi.fn(), error: vi.fn()}
 }));
 
-import {MailService} from '../../src/common/common.mail';
-import {salesforceApexRestPost, salesforceEnabled} from '../../src/common/salesforce.client';
+import {MailService} from '../../src/common/common.mail.js';
+import {salesforceApexRestPost, salesforceEnabled} from '../../src/common/salesforce.client.js';
 
-const mockPost = salesforceApexRestPost as jest.Mock;
-const mockEnabled = salesforceEnabled as jest.Mock;
+const mockPost = salesforceApexRestPost as Mock;
+const mockEnabled = salesforceEnabled as Mock;
 
 const httpError = (status: number, body?: any): any => {
 	const err: any = new Error('request failed with ' + status);
@@ -24,7 +25,7 @@ const httpError = (status: number, body?: any): any => {
 };
 
 beforeEach(() => {
-	jest.clearAllMocks();
+	vi.clearAllMocks();
 	mockEnabled.mockReturnValue(true);
 	mockPost.mockResolvedValue({status: 'SENT'});
 });

test/common/salesforce.client.test.ts

@@ -1,15 +1,15 @@
 // salesforce.client caches the OAuth token at module scope, so every test
-// resets the module registry for a clean cache and re-requires axios + the
+// resets the module registry for a clean cache and re-imports axios + the
 // module under test after the reset (same approach as
-// test/feedback/salesforce.service.test.ts).
+// test/feedback/salesforce.service.test.ts). Mocked modules survive
+// vi.resetModules(), so mock state is reset explicitly in beforeEach.
 
-export {}; // isolate module scope from other script-style test files
+import {vi, describe, it, expect, beforeEach, afterAll} from 'vitest';
+vi.mock('axios');
 
-jest.mock('axios');
-
-const freshImports = () => {
-	const axios = require('axios');
-	const {salesforceApexRestPost, salesforceEnabled} = require('../../src/common/salesforce.client');
+const freshImports = async () => {
+	const axios: any = (await import('axios')).default;
+	const {salesforceApexRestPost, salesforceEnabled} = await import('../../src/common/salesforce.client.js');
 	return {axios, salesforceApexRestPost, salesforceEnabled};
 };
 
@@ -23,7 +23,8 @@ const ENABLED_ENV = {
 };
 
 beforeEach(() => {
-	jest.resetModules();
+	vi.resetModules();
+	vi.resetAllMocks();
 	process.env = {...ENABLED_ENV};
 });
 
@@ -32,19 +33,19 @@ afterAll(() => {
 });
 
 describe('salesforceEnabled', () => {
-	it('is true only when SALESFORCE_ENABLED === "true"', () => {
+	it('is true only when SALESFORCE_ENABLED === "true"', async () => {
 		process.env.SALESFORCE_ENABLED = 'true';
-		expect(freshImports().salesforceEnabled()).toBe(true);
+		expect((await freshImports()).salesforceEnabled()).toBe(true);
 
-		jest.resetModules();
+		vi.resetModules();
 		process.env.SALESFORCE_ENABLED = 'false';
-		expect(freshImports().salesforceEnabled()).toBe(false);
+		expect((await freshImports()).salesforceEnabled()).toBe(false);
 	});
 });
 
 describe('salesforceApexRestPost', () => {
 	it('fetches a token, posts to the given Apex REST path, and returns the response body', async () => {
-		const {axios, salesforceApexRestPost} = freshImports();
+		const {axios, salesforceApexRestPost} = await freshImports();
 		axios.post.mockImplementation((url: string) => {
 			if (url.endsWith('/services/oauth2/token')) return Promise.resolve({data: {access_token: 'tok-1'}});
 			return Promise.resolve({data: {ok: true}});
@@ -66,7 +67,7 @@ describe('salesforceApexRestPost', () => {
 	});
 
 	it('reuses the cached token across calls instead of fetching twice', async () => {
-		const {axios, salesforceApexRestPost} = freshImports();
+		const {axios, salesforceApexRestPost} = await freshImports();
 		axios.post.mockImplementation((url: string) => {
 			if (url.endsWith('/services/oauth2/token')) return Promise.resolve({data: {access_token: 'tok-1'}});
 			return Promise.resolve({data: {}});
@@ -80,7 +81,7 @@ describe('salesforceApexRestPost', () => {
 	});
 
 	it('retries once with a fresh token on a 401, then succeeds', async () => {
-		const {axios, salesforceApexRestPost} = freshImports();
+		const {axios, salesforceApexRestPost} = await freshImports();
 		let tokenFetches = 0;
 		axios.post.mockImplementation((url: string) => {
 			if (url.endsWith('/services/oauth2/token')) {
@@ -102,7 +103,7 @@ describe('salesforceApexRestPost', () => {
 	});
 
 	it('does not retry on a non-401 error and rethrows it', async () => {
-		const {axios, salesforceApexRestPost} = freshImports();
+		const {axios, salesforceApexRestPost} = await freshImports();
 		axios.post.mockImplementation((url: string) => {
 			if (url.endsWith('/services/oauth2/token')) return Promise.resolve({data: {access_token: 'tok-1'}});
 			const err: any = new Error('Server error');
@@ -117,7 +118,7 @@ describe('salesforceApexRestPost', () => {
 
 	it('throws a clear error when client credentials are not configured', async () => {
 		process.env.SALESFORCE_CLIENT_ID = '';
-		const {salesforceApexRestPost} = freshImports();
+		const {salesforceApexRestPost} = await freshImports();
 
 		await expect(salesforceApexRestPost('/services/apexrest/email/send', {})).rejects.toThrow('SALESFORCE_CLIENT_ID');
 	});