Add end-to-end integration tests for the upload pipeline

[dobby-coder]

Context

From Dobby's night-shift report (dobby#23, recommendation 3):

cryptify has NO existing integration tests for the HTTP routes. Every test touching the upload pipeline has to spin up a Rocket Client::tracked(...) with a minimal app, or settle for unit tests.

While working on #99, the lack of end-to-end coverage made it hard to verify the full upload round-trip. Tests fell back to extractor-level Rocket client tests or pure-function unit tests.

Proposal

Add an integration-test harness that exercises the full upload flow:

POST /fileupload/init  →  PUT /fileupload/<uuid>  →  POST /fileupload/finalize/<uuid>

Required scaffolding:

• A fixture that stubs the Unsealer / PKG so tests don't need a live Yivi setup.
• A Rocket test client spun up once per integration test module.
• Temporary S3-compatible storage (e.g. MinIO in CI, or an in-memory backend behind a trait).
• Happy-path coverage plus the edge cases we've already hit in bug fixes (chunk > 1 MiB, invalid cryptify_token, zero-byte files, malformed Content-Range).

Benefits

• Catches regressions across extractor + handler + storage boundaries that unit tests miss.
• Gives future contributors confidence to refactor the upload state machine.
• Would have caught #38 and the upload_finalize token-validation regression fixed in fix: validate cryptifytoken header in upload_finalize #99.

Out of scope

• Does not replace existing unit tests.
• Does not require a real Yivi / PKG instance.

Filed on behalf of rubenhensen from dobby#23.

[rubenhensen]

/dobby fix this bug

[dobby-coder]

Dobby is on it! Dobby will look at issue #108 and fix the bug with great care! Dobby will report back as soon as Dobby has investigated!

[dobby-coder]

Dobby has put together a first slice as draft PR #109.

What it contains:

• Refactors rocket() to extract a build_rocket(figment, vk) builder so tests can inject a VerifyingKey without hitting a live PKG at startup.
• New email_stub config flag (default false) that short-circuits send_email so finalize's happy path runs without SMTP.
• 9 new integration tests covering the full init → chunk → finalize round-trip (single-chunk and multi-chunk happy paths using real pg-core sealing, plus 7 cross-handler edge cases).

Out of scope (deliberately): MinIO/trait-based storage abstraction, >= CHUNK_SIZE (10 MiB) single-chunk payload. Happy to follow up once this baseline lands — raising them now would bloat the PR.

Design questions flagged in the PR description (email_stub shape, dev-dep rand 0.8 alias, tests-in-main vs tests/ dir) — please weigh in before marking ready. All 36 tests pass locally (cargo test).