Sign panel sessions and isolate test runs

- Replace in-memory auth sessions with signed cookies and signed OAuth state
- Add auth route coverage and update panel/web server wiring
- Switch test script to per-file Bun processes and clean up type checks

package.json

@@ -28,8 +28,8 @@
     "db:migrate-config": "docker compose run --rm app bun shared/scripts/migrate-config-to-db.ts",
     "db:migrate-game-config": "docker compose run --rm app bun shared/scripts/migrate-game-settings-to-db.ts",
     "db:migrate-all": "docker compose run --rm app sh -c 'bun shared/scripts/migrate-config-to-db.ts && bun shared/scripts/migrate-game-settings-to-db.ts'",
-    "test": "bash shared/scripts/test-sequential.sh",
-    "test:ci": "bash shared/scripts/test-sequential.sh --integration",
+    "test": "bash shared/scripts/test-isolated.sh",
+    "test:ci": "bash shared/scripts/test-isolated.sh --integration",
     "test:simulate-ci": "bash shared/scripts/simulate-ci.sh",
     "panel:dev": "cd panel && bun run dev",
     "panel:build": "cd panel && bun run build",
@@ -48,4 +48,4 @@
     "postgres": "^3.4.8",
     "zod": "^4.3.6"
   }
-}
+}