Add backend test suite under backend/Tests/

Two xUnit projects, wired into Musify.slnx under a /Tests/ folder that
mirrors Core/ and Hosts/:

  Musify.Domain.Tests        Value-object logic (TrackAudio/TrackPictures'
                              IsProcessed/IsFailed/IsInProgress). Entities are
                              otherwise anemic EF models with no behavior to
                              test.
  Musify.Application.Tests   All ~45 Application handlers and services
                              (Albums, Tracks, PlayLists, Users, Mixes,
                              YouTube, plus TrackStreamIssuer,
                              UploadIntentValidator, YouTubeTrackProvisioner).

IDatabase exposes DbSet<T> directly, so handlers compose real LINQ queries
against it — that can't be expressed with a mock (no IQueryable provider
behind one). TestSupport/TestDatabase.cs is instead a real DbContext on a
private SQLite in-memory connection per test (fresh per test since xUnit
instantiates the test class per test method): fast, no external dependency,
and — unlike EF Core's InMemory provider — SQLite enforces real foreign keys
and supports transactions, which two handlers need. External dependencies
(IStorageService, IEventBus, IYouTubeMusicService, ...) are substituted with
NSubstitute.

TestSupport/TestEntities.cs and TestConfigurations.cs build fully-populated
domain entities and configuration POCOs with sensible defaults for every
required member, so no test method needs to fill in properties it doesn't
care about, and no builder ever hands back null.

Also, needed to make the Application layer itself testable without a real
Postgres or user-secrets:
- DatabaseDesignTimeFactory now falls back to the Database__ConnectionString
  env var, and DesignSettings.json is optional — unblocks the `migrate`
  one-shot container from deploy/compose.yml, which hit the same gap.
- Directory.Packages.props: xunit, xunit.runner.visualstudio, NSubstitute,
  Microsoft.EntityFrameworkCore.Sqlite (pinned to the same 10.0.8 as the rest
  of EF Core), Microsoft.NET.Test.Sdk, coverlet.collector. Also pins
  SQLitePCLRaw.bundle_e_sqlite3 to 2.1.13 — EFCore.Sqlite 10.0.8 pulls 2.1.11
  transitively, which has a known high-severity advisory (GHSA-2m69-gcr7-jv3q).
- backend/.dockerignore excludes Tests/: no application Dockerfile needs it
  in its build context.

162 tests, all green: `dotnet test backend/Musify.slnx`.

backend/Tests/Musify.Application.Tests/PlayLists/UpdatePlayListCommandHandlerTests.cs

@@ -0,0 +1,80 @@
+using ErrorOr;
+using Musify.Application.Contracts;
+using Musify.Application.PlayLists;
+using Musify.Application.Services;
+using Musify.Application.Tests.TestSupport;
+using NSubstitute;
+using Xunit;
+
+namespace Musify.Application.Tests.PlayLists;
+
+public sealed class UpdatePlayListCommandHandlerTests : HandlerTestBase
+{
+    private readonly IEventBus eventBus = Substitute.For<IEventBus>();
+    private readonly IStorageService storageService = Substitute.For<IStorageService>();
+
+    private UpdatePlayListCommandHandler CreateHandler() => new(
+        eventBus,
+        Database,
+        new UploadIntentValidator(Database, storageService),
+        NoOpLogger<UpdatePlayListCommandHandler>(),
+        TestConfigurations.Storage(),
+        TestConfigurations.PlayList(),
+        TestConfigurations.UploadIntent());
+
+    [Fact]
+    public async Task Handle_Owner_RenamesPlayList()
+    {
+        var owner = TestEntities.User();
+        var playList = TestEntities.PlayList(owner.Id, "Old Name");
+        await SeedAsync(owner, playList);
+
+        var command = new UpdatePlayListCommand(owner.Id, playList.Id, "New Name", null, null);
+
+        var result = await CreateHandler().Handle(command, CancellationToken.None);
+
+        Assert.False(result.IsError);
+        Assert.Equal("New Name", result.Value.Name);
+    }
+
+    [Fact]
+    public async Task Handle_PlayListMissing_ReturnsNotFound()
+    {
+        var command = new UpdatePlayListCommand(1, Guid.NewGuid(), "New Name", null, null);
+
+        var result = await CreateHandler().Handle(command, CancellationToken.None);
+
+        Assert.Equal(ErrorType.NotFound, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    {
+        var owner = TestEntities.User(1, "owner");
+        var stranger = TestEntities.User(2, "stranger");
+        var playList = TestEntities.PlayList(owner.Id);
+        await SeedAsync(owner, stranger, playList);
+
+        var command = new UpdatePlayListCommand(stranger.Id, playList.Id, "Hijacked", null, null);
+
+        var result = await CreateHandler().Handle(command, CancellationToken.None);
+
+        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task Handle_BlankNameAndDescription_LeavesThemUnchanged()
+    {
+        var owner = TestEntities.User();
+        var playList = TestEntities.PlayList(owner.Id, "Original Name", "Original description");
+        await SeedAsync(owner, playList);
+
+        var command = new UpdatePlayListCommand(owner.Id, playList.Id, "   ", "   ", null);
+
+        var result = await CreateHandler().Handle(command, CancellationToken.None);
+
+        Assert.False(result.IsError);
+        Assert.Equal("Original Name", result.Value.Name);
+        Assert.Equal("Original description", result.Value.Description);
+    }
+}