test post and comment controllers

Adds AuthenticatesUsers feature trait that runs the full
signup -> confirm -> login flow and exposes the resulting auth
cookie. Bumps phpunit defaultTimeLimit to 30 seconds so the
multi-bcrypt-per-test feature flow finishes inside the limit.

backend/tests/Feature/AuthenticatesUsers.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Email\EmailConfirmationToken\EmailConfirmationTokenRepository;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\User;
+use App\User\UserRepository;
+
+trait AuthenticatesUsers
+{
+    /**
+     * @return array{user: User, cookie: string}
+     */
+    private function signupAndLogin(
+        string $email,
+        string $displayName,
+        string $password,
+    ): array {
+        $this->postJson('/api/signup', [
+            'email' => $email,
+            'displayName' => $displayName,
+        ])->assertStatus(201);
+
+        $userRepo = $this->app->make(UserRepository::class);
+        $user = $userRepo->findByEmail(new EmailAddress($email));
+        $tokenRepo = $this->app->make(
+            EmailConfirmationTokenRepository::class,
+        );
+        $token = $tokenRepo->findByUser($user);
+
+        $this->postJson('/api/confirm-email', [
+            'token' => $token->getToken(),
+            'password' => $password,
+        ])->assertStatus(200);
+
+        $loginResponse = $this->postJson('/api/login', [
+            'email' => $email,
+            'password' => $password,
+        ]);
+        $loginResponse->assertStatus(200);
+        $cookie = $loginResponse->getCookie('auth_token', false);
+
+        $reloaded = $userRepo->findByEmail(new EmailAddress($email));
+
+        return [
+            'user' => $reloaded,
+            'cookie' => $cookie->getValue(),
+        ];
+    }
+
+    private function resetClientState(): void
+    {
+        $this->defaultCookies = [];
+        $this->unencryptedCookies = [];
+        $this->withCredentials = false;
+    }
+
+    private function promoteToAdmin(int $userId): void
+    {
+        $userRepo = $this->app->make(UserRepository::class);
+        $user = $userRepo->find($userId);
+        $userRepo->update(new User(
+            id: $user->getId(),
+            email: $user->getEmail(),
+            displayName: $user->getDisplayName(),
+            passwordHash: $user->getPasswordHash(),
+            isAdmin: true,
+            emailConfirmedAt: $user->getEmailConfirmedAt(),
+        ));
+    }
+}