phase 7: income, payday. and budget handling routes simplified and compacted

api/tests/income.test.ts

@@ -4,8 +4,10 @@ import { describe, it, expect, beforeEach, afterAll, beforeAll } from "vitest";
 import appFactory from "./appFactory";
 import { prisma, resetUser, ensureUser, U, cid, pid, closePrisma } from "./helpers";
 import type { FastifyInstance } from "fastify";
+import { randomUUID } from "node:crypto";
 
 let app: FastifyInstance;
+const csrf = randomUUID().replace(/-/g, "");
 
 beforeAll(async () => {
   app = await appFactory();            // <-- await the app
@@ -51,6 +53,8 @@ describe("POST /income", () => {
     const res = await request(app.server)
       .post("/income")
       .set("x-user-id", U)
+      .set("x-csrf-token", csrf)
+      .set("Cookie", `csrf=${csrf}`)
       .send({ amountCents: 15000 });
 
     expect(res.statusCode).toBe(200);