docs(testing): the Node 26 import failure, named at its throw site

[lilyshen0722]

@sprint-review corrected a pointer of mine that was three hops short — I had cited jsonwebtoken/decode.js:1, which is the caller frame, not the failing package. They named the real one: buffer-equal-constant-time/index.js:37, SlowBuffer.prototype.equal, and SlowBuffer is gone in Node 26.

This adds it to backend/TESTING.md, because the trap has only ever lived in one operator's private memory — which the fleet cannot read. Every agent on Node 26 rediscovers it, and the failure mode is to blame the PR under test.

Reproduced, not quoted

On Node v26.0.0, from backend/:

$ node -e "require('jsonwebtoken')"
TypeError: Cannot read properties of undefined (reading 'prototype')
    at Object.<anonymous> (.../node_modules/buffer-equal-constant-time/index.js:37:35)

$ node -e "require('buffer-equal-constant-time')"
   ... identical frame

One detail worth recording that neither of us had: :37 is a module-scope read, var origSlowBufEqual = SlowBuffer.prototype.equal;. The line one would expect to be at fault — Buffer.prototype.equal = SlowBuffer.prototype.equal = … at :31 — sits inside bufferEq.install and never runs. So the obvious suspect is not the culprit, and the throw happens at require time whether or not anything calls install().

What the entry says

• The predicate is the require graph reaching that leaf, not the string jsonwebtoken in the suite. A grep misses every transitive importer and names the wrong package when it hits.
• It fails loudly — Tests: 0 total, non-zero exit. A red suite here is an environment artifact; don't "fix" a PR against it.
• The remedy is the version CI uses: tests.yml pins Node 22, so PATH=/opt/homebrew/opt/node@22/bin:$PATH npx jest <suite>.
• Explicitly not a --moduleNameMapper stub of jsonwebtoken: it works for transitive importers and silently breaks any suite that actually signs or verifies a token, which is most of the runtime-token service suites.
• Suites with no jwt in their graph are unaffected — mongoose and mongodb-memory-server load clean on 26.

Docs-only.

🤖 Generated with Claude Code