Il repo resta al sito: app in radice, piattaforme nel loro repo

apps/sito passa in radice, apps/platforms si toglie: vive in
gitea:Adriano/InsanityLab-platforms, con la storia del repo comune. I piani e
le specifiche di Longevity e Campus lasciano docs/ e seguono le piattaforme.
README e compose: deploy da /opt/docker/insanitylab/src; al primo deploy .env
va spostato da apps/sito/.env alla radice.

Refs #20

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/users.test.ts

@@ -0,0 +1,49 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import type Database from 'better-sqlite3';
+import { createDb } from '../src/lib/db';
+import {
+  createUser, countAdmins, getUserById, updateUserRole,
+  updateUserPassword, deleteUser, randomPassword, isRole, hashPassword, verifyPassword,
+} from '../src/lib/auth';
+
+let db: Database.Database;
+beforeEach(() => { db = createDb(':memory:'); });
+
+describe('gestione utenti', () => {
+  it('countAdmins conta i soli admin', () => {
+    createUser(db, 'a1', 'segreta123', 'admin');
+    createUser(db, 's1', 'segreta123', 'superuser');
+    expect(countAdmins(db)).toBe(1);
+  });
+
+  it('updateUserRole e getUserById', () => {
+    const id = createUser(db, 'u1', 'segreta123', 'user');
+    updateUserRole(db, id, 'superuser');
+    expect(getUserById(db, id)!.role).toBe('superuser');
+  });
+
+  it('updateUserPassword cambia l’hash', () => {
+    const id = createUser(db, 'u2', 'vecchia123', 'user');
+    updateUserPassword(db, id, hashPassword('nuova12345'));
+    const hash = (db.prepare('SELECT password_hash AS h FROM users WHERE id = ?').get(id) as { h: string }).h;
+    expect(verifyPassword('nuova12345', hash)).toBe(true);
+  });
+
+  it('deleteUser rimuove', () => {
+    const id = createUser(db, 'u3', 'segreta123', 'user');
+    deleteUser(db, id);
+    expect(getUserById(db, id)).toBeNull();
+  });
+
+  it('randomPassword genera almeno 12 caratteri', () => {
+    expect(randomPassword().length).toBeGreaterThanOrEqual(12);
+  });
+
+  it('isRole valida i ruoli', () => {
+    expect(isRole('admin')).toBe(true);
+    expect(isRole('superuser')).toBe(true);
+    expect(isRole('user')).toBe(true);
+    expect(isRole('editor')).toBe(false);
+    expect(isRole(3)).toBe(false);
+  });
+});