test: standalone test container, isolated from the live prod stack

Adds a `test` stage to the Dockerfile (prod deps + pytest + aiosqlite via
the `dev` extras, never shipped) and a docker-compose.test.yml that runs
it under its own Compose project name (`cassandra-test`). The project-name
isolation matters because this host runs prod — a wrong `compose up` would
otherwise recreate the live `app` container; namespaced project means the
test container can't touch any prod container/network/volume.

Tests use an in-memory aiosqlite DB (per tests/conftest.py) so the
container has no MariaDB / Redis dependency and nothing on the prod DB
is observed or mutated.

Also adds aiosqlite to dev extras — tests have always implicitly needed
it (the conftest pins DATABASE_URL to sqlite+aiosqlite:///:memory:); the
declaration was just missing.

Usage:
  docker compose -f docker-compose.test.yml run --rm test
  docker compose -f docker-compose.test.yml run --rm test pytest -k unsubscribe

docker-compose.test.yml

@@ -0,0 +1,46 @@
+# Ad-hoc test runner.
+#
+# STANDALONE — do not combine with docker-compose.yml. The `name:` field
+# below puts the test container in its own Compose project (`cassandra-test`)
+# so it CANNOT collide with the live prod stack on this host (containers,
+# networks, volumes are all namespaced by project).
+#
+# Usage:
+#   # Run the full suite:
+#   docker compose -f docker-compose.test.yml run --rm test
+#
+#   # Run a specific file or test:
+#   docker compose -f docker-compose.test.yml run --rm test pytest tests/test_email_digest_job.py -v
+#   docker compose -f docker-compose.test.yml run --rm test pytest -k unsubscribe
+#
+#   # Open a shell in the test image (e.g. to poke around with pytest --pdb):
+#   docker compose -f docker-compose.test.yml run --rm test bash
+#
+#   # Rebuild after a pyproject.toml change:
+#   docker compose -f docker-compose.test.yml build test
+#
+# Tests use an in-memory aiosqlite DB (see tests/conftest.py), so there is
+# no MariaDB / Redis dependency and nothing touches the prod database.
+
+name: cassandra-test
+
+services:
+  test:
+    build:
+      context: .
+      target: test
+    # Same volume mounts as the dev override — edits on the host take effect
+    # on the next `run` without rebuilding the image.
+    volumes:
+      - ./app:/app/app
+      - ./tests:/app/tests
+      - ./alembic:/app/alembic
+      - ./alembic.ini:/app/alembic.ini:ro
+      - ./config:/app/config:ro
+      - ./pyproject.toml:/app/pyproject.toml:ro
+    environment:
+      # Sentinels so app.config can be imported without a real .env / DB.
+      # tests/conftest.py also sets these defensively.
+      DATABASE_URL: "sqlite+aiosqlite:///:memory:"
+      CASSANDRA_MOCK: "1"
+      PYTHONDONTWRITEBYTECODE: "1"