Add backend test suite under backend/Tests/

Two xUnit projects, wired into Musify.slnx under a /Tests/ folder that
mirrors Core/ and Hosts/:

  Musify.Domain.Tests        Value-object logic (TrackAudio/TrackPictures'
                              IsProcessed/IsFailed/IsInProgress). Entities are
                              otherwise anemic EF models with no behavior to
                              test.
  Musify.Application.Tests   All ~45 Application handlers and services
                              (Albums, Tracks, PlayLists, Users, Mixes,
                              YouTube, plus TrackStreamIssuer,
                              UploadIntentValidator, YouTubeTrackProvisioner).

IDatabase exposes DbSet<T> directly, so handlers compose real LINQ queries
against it — that can't be expressed with a mock (no IQueryable provider
behind one). TestSupport/TestDatabase.cs is instead a real DbContext on a
private SQLite in-memory connection per test (fresh per test since xUnit
instantiates the test class per test method): fast, no external dependency,
and — unlike EF Core's InMemory provider — SQLite enforces real foreign keys
and supports transactions, which two handlers need. External dependencies
(IStorageService, IEventBus, IYouTubeMusicService, ...) are substituted with
NSubstitute.

TestSupport/TestEntities.cs and TestConfigurations.cs build fully-populated
domain entities and configuration POCOs with sensible defaults for every
required member, so no test method needs to fill in properties it doesn't
care about, and no builder ever hands back null.

Also, needed to make the Application layer itself testable without a real
Postgres or user-secrets:
- DatabaseDesignTimeFactory now falls back to the Database__ConnectionString
  env var, and DesignSettings.json is optional — unblocks the `migrate`
  one-shot container from deploy/compose.yml, which hit the same gap.
- Directory.Packages.props: xunit, xunit.runner.visualstudio, NSubstitute,
  Microsoft.EntityFrameworkCore.Sqlite (pinned to the same 10.0.8 as the rest
  of EF Core), Microsoft.NET.Test.Sdk, coverlet.collector. Also pins
  SQLitePCLRaw.bundle_e_sqlite3 to 2.1.13 — EFCore.Sqlite 10.0.8 pulls 2.1.11
  transitively, which has a known high-severity advisory (GHSA-2m69-gcr7-jv3q).
- backend/.dockerignore excludes Tests/: no application Dockerfile needs it
  in its build context.

162 tests, all green: `dotnet test backend/Musify.slnx`.

backend/Tests/Musify.Application.Tests/Tracks/DeleteTrackCommandHandlerTests.cs

@@ -0,0 +1,76 @@
+using ErrorOr;
+using Musify.Application.Contracts;
+using Musify.Application.Tests.TestSupport;
+using Musify.Application.Tracks;
+using Musify.Domain.ValueObjects;
+using NSubstitute;
+using Xunit;
+
+namespace Musify.Application.Tests.Tracks;
+
+public sealed class DeleteTrackCommandHandlerTests : HandlerTestBase
+{
+    private readonly IEventBus eventBus = Substitute.For<IEventBus>();
+
+    private DeleteTrackCommandHandler CreateHandler() => new(Database, eventBus, NoOpLogger<DeleteTrackCommandHandler>());
+
+    [Fact]
+    public async Task Handle_Owner_MarksTrackAsRemovingAndPublishesEvent()
+    {
+        var owner = TestEntities.User();
+        var track = TestEntities.LocalTrack(owner);
+        await SeedAsync(owner, track);
+
+        var result = await CreateHandler().Handle(new DeleteTrackCommand(owner.Id, track.Id), CancellationToken.None);
+
+        Assert.False(result.IsError);
+        var stored = await Database.Tracks.FindAsync(track.Id);
+        Assert.NotNull(stored);
+        Assert.Equal(LifeCycleStatus.Removing, stored.LifeCycleStatus);
+        await eventBus.Received(1).PublishAsync(Arg.Any<Musify.Application.Events.DeleteTrackEvent>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Handle_TrackMissing_ReturnsNotFound()
+    {
+        var result = await CreateHandler().Handle(new DeleteTrackCommand(1, Guid.NewGuid()), CancellationToken.None);
+
+        Assert.Equal(ErrorType.NotFound, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    {
+        var owner = TestEntities.User(1, "owner");
+        var stranger = TestEntities.User(2, "stranger");
+        var track = TestEntities.LocalTrack(owner);
+        await SeedAsync(owner, stranger, track);
+
+        var result = await CreateHandler().Handle(new DeleteTrackCommand(stranger.Id, track.Id), CancellationToken.None);
+
+        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task Handle_ExternalTrack_ReturnsUnauthorized()
+    {
+        var externalTrack = TestEntities.ExternalTrack();
+        await SeedAsync(externalTrack);
+
+        var result = await CreateHandler().Handle(new DeleteTrackCommand(1, externalTrack.Id), CancellationToken.None);
+
+        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task Handle_AudioStillProcessing_ReturnsConflict()
+    {
+        var owner = TestEntities.User();
+        var track = TestEntities.LocalTrack(owner, audio: TestEntities.PendingAudio());
+        await SeedAsync(owner, track);
+
+        var result = await CreateHandler().Handle(new DeleteTrackCommand(owner.Id, track.Id), CancellationToken.None);
+
+        Assert.Equal(ErrorType.Conflict, result.FirstError.Type);
+    }
+}