Stop spy call history leaking between API test files

[ebma]

Summary

supabaseAuth.test.ts > "continues anonymously only when optional auth receives no credential" fails when it runs after vortexAdminAuth.test.ts. It passes on its own and under CI's file order. I found it while running the full API suite in the OSS Scanner image (#1430).

Root cause: bun restores a spied method when its test file ends, but keeps the spy's call history. A later file's spyOn() on the same method starts with the earlier file's calls. Here the victim's fresh verifyToken spy already held two ["whatever"] calls from vortexAdminAuth.test.ts.

Fix: the three API test files that call spyOn() but never restore now call mock.restore() in their existing afterEach, like every other spying test file:

• vortexAdminAuth.test.ts
• admin-console.route.test.ts
• impersonation.service.test.ts

All their spies are installed inside individual tests, so restoring after each test changes nothing within those files.

Guard: src/tests/spy-restore.invariants.test.ts fails if any API test file calls spyOn() without mock.restore() or .mockRestore(). A runtime reproducer would depend on bun's file order, so the guard checks the rule directly.

Verification

All runs in the OSS Scanner image, offline:

• Before the fix:
  • vortexAdminAuth.test.ts + supabaseAuth.test.ts gives 1 fail.
  • The guard fails and names exactly the three files.
• After the fix:
  • The guard passes.
  • Each of the three files paired with supabaseAuth.test.ts passes.
  • The full API suite gives 2313 pass, 54 skip, 0 fail (before: 2311 pass, 1 fail).
• tsc --noEmit passes for apps/api.

[netlify]

✅ Deploy Preview for vortexfi canceled.

Name	Link
🔨 Latest commit	206d903
🔍 Latest deploy log	https://app.netlify.com/projects/vortexfi/deploys/6accddb7477f4ead71f0a396

[netlify]

✅ Deploy Preview for vrtx-dashboard canceled.

Name	Link
🔨 Latest commit	206d903
🔍 Latest deploy log	https://app.netlify.com/projects/vrtx-dashboard/deploys/6accddb7d05b164c121b8011

[netlify]

✅ Deploy Preview for vortex-sandbox ready!

Name	Link
🔨 Latest commit	206d903
🔍 Latest deploy log	https://app.netlify.com/projects/vortex-sandbox/deploys/6accddb7755491e1563a025a
😎 Deploy Preview	https://deploy-preview-1431--vortex-sandbox.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.