test: add comprehensive test suite (44 → 169 tests) and v1.1 plan

Add 125 new test functions across 10 new test files, covering:
- CSRF middleware (8 tests): double-submit cookie validation
- Auth middleware (12 tests): SessionLoader, RequireAdmin, context helpers
- API handlers (28 tests): auth, faves CRUD, tags, users, export/import
- Web handlers (41 tests): signup, login, password reset, fave CRUD,
  admin panel, feeds, import/export, profiles, settings
- Config (8 tests): env parsing, defaults, trusted proxies, normalization
- Database (6 tests): migrations, PRAGMAs, idempotency, seeding
- Image processing (10 tests): JPEG/PNG, resize, EXIF strip, path traversal
- Render (6 tests): page/error/partial rendering, template functions
- Settings store (3 tests): CRUD operations
- Regression tests for display name fallback and CSP-safe autocomplete

Also adds CSRF middleware to testServer chain for end-to-end CSRF
verification, TESTPLAN.md documenting coverage, and PLANS-v1.1.md
with implementation plans for notes+OG, PWA, editing UX, and admin.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/store/settings_test.go

@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package store
+
+import (
+	"testing"
+)
+
+func TestSettingsGetDefault(t *testing.T) {
+	db := testDB(t)
+	settings := NewSettingsStore(db)
+
+	s, err := settings.Get()
+	if err != nil {
+		t.Fatalf("get default settings: %v", err)
+	}
+
+	// Migration should insert a default row.
+	if s.SiteName == "" {
+		t.Error("expected non-empty default site name")
+	}
+	if s.SignupMode == "" {
+		t.Error("expected non-empty default signup mode")
+	}
+}
+
+func TestSettingsUpdate(t *testing.T) {
+	db := testDB(t)
+	settings := NewSettingsStore(db)
+
+	err := settings.Update("Nye Favoritter", "En kul side", "requests")
+	if err != nil {
+		t.Fatalf("update settings: %v", err)
+	}
+
+	s, err := settings.Get()
+	if err != nil {
+		t.Fatalf("get after update: %v", err)
+	}
+
+	if s.SiteName != "Nye Favoritter" {
+		t.Errorf("site_name = %q, want %q", s.SiteName, "Nye Favoritter")
+	}
+	if s.SiteDescription != "En kul side" {
+		t.Errorf("site_description = %q, want %q", s.SiteDescription, "En kul side")
+	}
+	if s.SignupMode != "requests" {
+		t.Errorf("signup_mode = %q, want %q", s.SignupMode, "requests")
+	}
+	if s.UpdatedAt.IsZero() {
+		t.Error("expected non-zero updated_at after update")
+	}
+}
+
+func TestSettingsUpdatePreservesOtherFields(t *testing.T) {
+	db := testDB(t)
+	settings := NewSettingsStore(db)
+
+	// Set initial values.
+	settings.Update("Site A", "Desc A", "open")
+
+	// Update with different values.
+	settings.Update("Site B", "Desc B", "closed")
+
+	s, _ := settings.Get()
+	if s.SiteName != "Site B" {
+		t.Errorf("site_name = %q, want %q", s.SiteName, "Site B")
+	}
+	if s.SiteDescription != "Desc B" {
+		t.Errorf("site_description = %q, want %q", s.SiteDescription, "Desc B")
+	}
+	if s.SignupMode != "closed" {
+		t.Errorf("signup_mode = %q, want %q", s.SignupMode, "closed")
+	}
+}