test: make the suite's assertions falsifiable and its state isolated

Several assertions could not fail:

- "the catch update remains saved" was `caught.isChecked() || notes.includes(...)`
  shared by two scenarios, so either half satisfied both. Split into two steps
  that each assert the outcome their own scenario is about.
- The token-refresh check read a global counter with `> 0` and asserted an upload
  had happened `some(...)`, both already satisfied by the preceding scenario. It
  now asserts exactly one refresh, ordered before the upload.
- The box step ignored its box argument and asserted on the first N entries on
  the page; it now scopes to that box and checks its full contents.
- The filter step asserted on whichever entry was first after filtering; it now
  records the caught entry beforehand and names it, and checks the filter did not
  exclude everything.
- The empty-state precondition asserted emptiness instead of establishing it,
  which a fresh user satisfies for free.
- Offline coverage was `caches.keys().length > 0`. It now checks the precache
  contract: one workbox cache holding the shell and a revisioned web manifest,
  with _app/immutable assets cached without a revision query. The scenario that
  claimed to test a trailing slash did not; it is replaced with real offline
  client-side navigation.

The mock provider kept recorded requests, its refresh counter and the
fail-uploads switch in one process-wide object that only one step reset, so
scenario order was load-bearing and the failing-upload scenario poisoned
everything after it. An auto fixture now resets it per scenario, and the mock no
longer records its own control-plane calls. That reset is why the suite stays on
a single worker, which is now documented.

Coverage was gated at 90% per file over an allowlist of exactly the five files
that had tests, so new code was invisible to it permanently. It now measures all
of src/lib with global thresholds at the measured baseline, and no longer runs
the unit tests twice.

Also: a global teardown removes the users each run creates, the Supabase wrapper
distinguishes a stopped stack from a broken CLI call and detects an unseeded
database, the sign-in rate limit is raised above what one serial run needs, and
the integration suite no longer falls back to a hard-coded anon key that would
mask a misconfigured run.

The password-reset scenarios are renamed to what they actually cover: following a
real recovery link bounces to /signin, because the browser client persists no
cookies and so cannot keep the session it parses out of the URL. The helper for
the real flow is left in place and the gap is documented.

scripts/mock-provider-server.mjs

@@ -14,7 +14,12 @@ const server = createServer(async (request, response) => {
 	const url = new URL(request.url ?? '/', `http://127.0.0.1:${port}`);
 	let body = '';
 	for await (const chunk of request) body += chunk;
-	state.requests.push({ method: request.method, path: url.pathname, query: url.search, body });
+
+	// Control-plane calls (including Playwright's webServer readiness polling of /__mock/state)
+	// must not show up as provider traffic the assertions then reason about.
+	if (!url.pathname.startsWith('/__mock/')) {
+		state.requests.push({ method: request.method, path: url.pathname, query: url.search, body });
+	}
 
 	if (url.pathname === '/__mock/state') return send(response, 200, state);
 	if (url.pathname === '/__mock/reset') {

scripts/run-with-local-supabase.mjs

@@ -8,25 +8,44 @@ if (!command) {
 	process.exit(2);
 }
 
+const SETUP_HINT = 'Run "npm run supabase:start" followed by "npm run supabase:reset".';
+// npx is a shell script on Windows, where spawn needs a shell to find it.
+const useShell = process.platform === 'win32';
+
+function fail(message, detail) {
+	console.error(message);
+	if (detail) console.error(String(detail).trim());
+	process.exit(1);
+}
+
 const status = spawnSync('npx', ['supabase', 'status', '--output', 'json'], {
 	encoding: 'utf8',
-	stdio: ['ignore', 'pipe', 'pipe']
+	stdio: ['ignore', 'pipe', 'pipe'],
+	shell: useShell
 });
 
+if (status.error) {
+	fail(
+		'Unable to run "npx supabase status" - is the supabase CLI installed?',
+		status.error.message
+	);
+}
+
 if (status.status !== 0) {
-	console.error('Local Supabase is required but is not running.');
-	console.error('Run "npm run supabase:start" followed by "npm run supabase:reset".');
-	if (status.stderr.trim()) console.error(status.stderr.trim());
-	process.exit(status.status ?? 1);
+	const stderr = status.stderr ?? '';
+	// Distinguish a stopped stack from a genuinely broken CLI invocation, so the hint is only
+	// printed when it is actually the advice the reader needs.
+	if (/not running|supabase start/i.test(stderr)) {
+		fail(`Local Supabase is required but is not running.\n${SETUP_HINT}`, stderr);
+	}
+	fail(`"supabase status" failed with exit code ${status.status}.`, stderr);
 }
 
 let values;
 try {
 	values = JSON.parse(status.stdout);
 } catch (error) {
-	console.error('Unable to parse "supabase status --output json".');
-	console.error(error);
-	process.exit(1);
+	fail('Unable to parse "supabase status --output json".', error);
 }
 
 const apiUrl = values.API_URL ?? values.api_url ?? 'http://127.0.0.1:54321';
@@ -34,12 +53,30 @@ const anonKey = values.ANON_KEY ?? values.PUBLISHABLE_KEY ?? values.anon_key;
 const serviceRoleKey = values.SERVICE_ROLE_KEY ?? values.SECRET_KEY ?? values.service_role_key;
 
 if (!anonKey || !serviceRoleKey) {
-	console.error('Supabase status did not return an anonymous and service-role key.');
-	process.exit(1);
+	fail(`Supabase status did not return an anonymous and service-role key.\n${SETUP_HINT}`);
+}
+
+// A running-but-unseeded database is the most common broken state, and it surfaces downstream as
+// a confusing assertion failure. Check it here instead.
+const probe = await fetch(`${apiUrl}/rest/v1/pokedex_entries?select=id&limit=1`, {
+	headers: { apikey: anonKey, Authorization: `Bearer ${anonKey}` }
+}).catch((error) => {
+	fail(`Unable to reach the local Supabase REST API at ${apiUrl}.\n${SETUP_HINT}`, error);
+});
+
+if (!probe.ok) {
+	fail(
+		`The local Supabase database has no readable pokedex_entries (HTTP ${probe.status}).\n${SETUP_HINT}`,
+		await probe.text()
+	);
+}
+if (((await probe.json()) ?? []).length === 0) {
+	fail(`The local Supabase database is empty - migrations or seeds have not run.\n${SETUP_HINT}`);
 }
 
 const child = spawnSync(command, args, {
 	stdio: 'inherit',
+	shell: useShell,
 	env: {
 		...process.env,
 		PUBLIC_SUPABASE_URL: process.env.PUBLIC_SUPABASE_URL ?? apiUrl,
@@ -51,4 +88,6 @@ const child = spawnSync(command, args, {
 	}
 });
 
-process.exit(child.status ?? 1);
+if (child.error) fail(`Unable to run "${command}".`, child.error.message);
+// A signalled child reports status === null; exiting 0 there would hide the failure.
+process.exit(child.signal ? 1 : child.status ?? 1);