Add integration tests for the base website and ticket purchase flow

[daedeloth]

Summary

HTTP-level integration tests proving the public site renders and the full ticket purchase flow works — free and paid — against a real MySQL 8 database with every external service faked. Runs inside the docker-compose webserver container (production PHP) against a dedicated catlab_events_test database, so dev data is never touched and no local PHP/DB setup is needed:

bin/integration-tests.sh

Stacked on #49 (needs the PHP 8.5 image) — merge that first, then retarget/merge this.

What's covered (10 tests)

• Smoke: homepage, event page, ticket-selection page render.
• Free purchase: select → process → order ACCEPTED, thanks page renders, confirmation email requested, no payment API involved, Eukles tracking fired (all via fakes).
• Paid purchase: order created remotely (faked), redirect to payUrl, PSP callback orders/{id}/sync flips the order to ACCEPTED — exercised both authenticated and as a guest, locking in the unauthenticated-callback contract real PSP calls depend on.
• Guards: register routes redirect guests to login; no order is created.
• migrate:fresh on a clean MySQL 8 every run — proves the migration chain end-to-end.

Production changes (2, both deliberate)

1. CatLabApiClientFactory seam — the three direct new ApiClient(...) sites (EventController, Order, SendEmail) now resolve a factory from the container so tests can bind a fake. Behavior identical in production.
2. Bug fix (found by these tests): free orders were cancelled by the thanks page. Order::synchronize() cancelled any order lacking a catlab_order_id; free orders never get one, and the thanks page calls synchronize(). It now only cancels orders still PENDING. Side benefit: the unauthenticated GET orders/{id}/sync can no longer flip an accepted or refunded order to CANCELLED (which re-fired cancellation email + UitPAS cancel).

Also: mockery/mockery dev-dependency bumped 0.9 → ^1.6 (0.9 fatals under PHP 8.5 inside Laravel's RefreshDatabase; nothing in the repo uses the Mockery API directly).

Deviations from the spec (documented)

• The plan's fixture code predated schema drift: events.startDate/endDate moved to the event_dates table (2021), description/event_type are NOT NULL, requires_team defaults true — the fixtures trait adapts, with comments.
• The free-flow test POSTs /process directly rather than walking select → confirm first; confirmRegister and the PreparingOrder event are not yet exercised.

Known follow-ups (pre-existing, out of scope)

• Order::synchronize() compares $this->status, which is not a column (always null) — the "don't go cancelled → pending" guard is dead code.
• Order::getEuklesAttributes() does $data['price'] on a null getOrderData() result for orders without a catlab_order_id.
• Organisation::getRepresentedOrganisation()'s function-static cache makes some smoke-test outcomes order-dependent within one phpunit process.
• docker-compose maps MySQL to host port 3312, which can collide with other local projects (tests are unaffected — they use the internal network).

Verification

• bin/integration-tests.sh: OK (10 tests, 36 assertions)
• Host vendor/bin/phpunit --testsuite Unit: OK (9 tests) — still DB-free
• Whole-branch review + fix wave completed; per-task review on every commit

🤖 Generated with Claude Code

https://claude.ai/code/session_013HqprN6hPwwHLXeCRbGdgo