test(ci): isolate Cloudflare Workers test services

[riderx]

Summary

• Make the backend and Cloudflare Workers integration environments deterministic by stopping the autonomous test scheduler before either server starts.
• Take the scheduler's existing advisory lock, unschedule process_all_cron_tasks, drain already-submitted pg_net callbacks, and purge seeded PGMQ work.
• Keep queue and cron coverage explicit: tests seed and invoke the work they assert, rather than inheriting startup traffic.
• Preserve the audit fixture's generated super-admin binding instead of deleting the last protected binding.
• The earlier commits in this PR also isolate organization locks, queue completion, webhook fixtures, CLI lifecycles, and authenticated organization updates.

Test plan

• bun test:db (Tinbase) — 18 files / 252 tests passed.
• bunx tsc --ignoreConfig --noEmit --skipLibCheck --target ESNext --module NodeNext --moduleResolution NodeNext scripts/quiesce-test-scheduler.ts
• bunx eslint --no-ignore scripts/quiesce-test-scheduler.ts tests/audit-logs.test.ts
• bunx vitest run tests/organization-put-stripe-sync.unit.test.ts — 11 tests passed.
• Full GitHub Actions matrix — 21 jobs passed, including backend shards 1/2 and 2/2 plus Cloudflare Workers shards 1/2 and 2/2.

Screenshots

Not applicable — backend and CI test-isolation changes only.

Checklist

• My code follows the code style of this project and passes bun run lint:backend && bun run lint in CI.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce my tests.

---

Note

Medium Risk
Touches organization PUT (Stripe rollback path), API-key middleware routing, and queue/background execution—important areas—but changes are scoped to test isolation and explicit primary-DB writes with added unit/SQL coverage.

Overview
CI integration jobs now run isolated Supabase worktrees (per-job port bands, concurrency groups, scoped supabase-worktree.ts for start/serve/test/stop) and export dynamic health/DB URLs instead of hard-coded 127.0.0.1:54321. Backend and Cloudflare shards get matching worker port offsets and separate Wrangler persist dirs; Cloudflare tests run through supabase:with-env.

A new quiesce-test-scheduler step stops autonomous cron/pg_net/PGMQ work before Edge/Workers boot so tests don’t race startup traffic. CAPGO_PREVENT_BACKGROUND_FUNCTIONS and queue wait_for_completion / x-capgo-wait-for-completion (only honored with internal API secret) make background work deterministic in CI.

Runtime fixes: org updates go through primary Postgres with JWT/API-key audit context; root bundle and app POST mutations resolve API keys on Postgres (not replica). S3 adds S3_REWRITE_LOCAL_ENDPOINT=false for isolated workers; functions get worktree-specific .env for storage endpoints. SQL migration narrows org tombstone locking to per-org advisory locks (not global table lock).

Tests: widespread switch from fetchWithRetry to fetchTestRequest, createIsolatedSeedAppOptions for CLI suites, removal of flaky retry helpers, and CI splits for serial CLI/read-replica cases.

^{Reviewed by Cursor Bugbot for commit 4d92e90. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and matches the PR’s main theme of isolating Cloudflare Workers test services.
Description check	✅ Passed	The description follows the template with Summary, Test plan, Screenshots, and Checklist sections filled in.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing codex/fix-cloudflare-organization-fixture (4d92e90) with main (72bfb1c)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7b222e61-944d-4281-a126-8cda39a7f000)

[cursor]

Stale comment

Risk: low. Cursor Bugbot did not complete (skipped due to usage limit), so the required automated review signal is unavailable. Human review is needed before merge; reviewers have been assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[cursor]

Stale comment

Risk: low. Not approving because Cursor Bugbot skipped (usage limit reached) and did not complete its review. Assigned Dalanir and WcaleNieWolny for human review of this test-only fixture change.

  

_{Sent by Cursor Approval Agent: Pull Request Approver External}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3662b691-1f08-47dd-988e-86a3d7df108e)

[cursor]

Stale comment

Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not complete its review. Dalanir and WcaleNieWolny are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[cursor]

Stale comment

Risk: low. Not approving because Cursor Bugbot skipped (usage limit reached) and did not complete its review. Human review is still needed; Dalanir and WcaleNieWolny are already assigned as reviewers.

  

_{Sent by Cursor Approval Agent: Pull Request Approver External}

[riderx]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_dfded065-0d86-447c-8038-cbfdd4731f11)

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[riderx]

@coderabbitai review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5375f7eb-b255-449c-9910-36e9f24742a1)

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cursor]

Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not complete its review. Dalanir and WcaleNieWolny are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[cursor]

Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not complete its review, and this PR includes backend and migration changes beyond test-only scope. Human review is still needed; Dalanir and WcaleNieWolny are already assigned as reviewers.

  

_{Sent by Cursor Approval Agent: Pull Request Approver External}