test: standalone test container, isolated from the live prod stack

Adds a `test` stage to the Dockerfile (prod deps + pytest + aiosqlite via
the `dev` extras, never shipped) and a docker-compose.test.yml that runs
it under its own Compose project name (`cassandra-test`). The project-name
isolation matters because this host runs prod — a wrong `compose up` would
otherwise recreate the live `app` container; namespaced project means the
test container can't touch any prod container/network/volume.

Tests use an in-memory aiosqlite DB (per tests/conftest.py) so the
container has no MariaDB / Redis dependency and nothing on the prod DB
is observed or mutated.

Also adds aiosqlite to dev extras — tests have always implicitly needed
it (the conftest pins DATABASE_URL to sqlite+aiosqlite:///:memory:); the
declaration was just missing.

Usage:
  docker compose -f docker-compose.test.yml run --rm test
  docker compose -f docker-compose.test.yml run --rm test pytest -k unsubscribe

Dockerfile

@@ -32,3 +32,29 @@ COPY alembic.ini ./
 # Default command is the web app; scheduler container overrides via `command:`.
 EXPOSE 8000
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]
+
+
+# ---------------------------------------------------------------------------
+# Test stage — same Python, same prod deps, plus dev extras (pytest +
+# aiosqlite). Built and run only via docker-compose.test.yml; never shipped.
+# ---------------------------------------------------------------------------
+FROM python:3.13-slim AS test
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH="/opt/venv/bin:$PATH" \
+    TZ=UTC \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1
+
+COPY --from=builder /opt/venv /opt/venv
+WORKDIR /app
+COPY pyproject.toml ./
+COPY app ./app
+COPY alembic ./alembic
+COPY alembic.ini ./
+COPY tests ./tests
+
+RUN /opt/venv/bin/pip install ".[dev]"
+
+CMD ["pytest", "tests/", "-v"]