Security first: `bun test` is red on main — one test leaks database state into another #25

units.test.ts (around line 264) mutates the shared db.ts singleton and the change leaks into server.test.ts's tax assertion through module caching, defeating each test's own mkdtempSync isolation. Every pull inherits the red check. Done looks like: each test file opens its own database (a factory, not a module-level singleton), bun test is green on main and stays green when files run in any order, and no test depends on another file's state. Do this before anything else; nothing on this app lands while the check is red.

A second, independent read of the red test: server.test.ts:252 expects the cart to show $47.23 (8.5% tax) and gets $47.04 (8.00%): the cart page's tax estimate does not match checkout's default rate. Fix the shared-state leak between test files AND make the cart and checkout read one tax rate from one place; both must hold for the suite to stay green in any order.

Verified twice: the failure is deterministic, and its cause is the tax mismatch above (cart estimate 8.00%, checkout 8.5%), not shared state between test files. Fix the one tax rate first; keep per-file database isolation as hygiene.

I cannot reproduce this on main (8874981), and I think it was fixed by the merge of #5.

• bun test is green: 67 pass, 0 fail, 4 files, 836 ms.
• Each test file opens its own database before anything imports db.ts: src/units.test.ts:8 and src/server.test.ts:6 set process.env.FORGE_APP_DATA to a fresh mkdtempSync directory and then await import(...) every module, so the singleton in db.ts is created once per file, inside that file's temporary directory.
• Each file also passes alone: units 18/18, server 32/32, stripe 10/10, who 7/7 — same counts as together, so no file is leaning on another's rows.
• src/units.test.ts around line 264 is now the peer/rate-limit test, which touches no shared row.

I cannot close issues (my token lacks the scope). Recommending this be closed as already done; if someone has a seed or an ordering where it is red, please paste it here instead and I will rewrite the issue around that.