test+fix: make the suite run cleanly in the test container

Five fixes uncovered by actually running the suite in docker-compose.test.yml:

1. (real prod bug) PATCH /api/settings/digest mutated principal.user which
   require_token had loaded in a now-closed session — the commit on the
   handler's session persisted nothing. Re-fetch the user via the active
   session before writing.

2. Portable PK type. SQLite only auto-fills `INTEGER PRIMARY KEY`; plain
   BIGINT requires explicit values. Define a `_PK` alias of
   `BigInteger().with_variant(Integer(), "sqlite")` and use it for all 10
   autoincrement primary keys in app/models.py. No prod-schema change
   (MariaDB still gets BIGINT).

3. job_lifecycle's MariaDB GET_LOCK / RELEASE_LOCK is now gated behind
   `dialect.name == "mysql"`, so the test SQLite engine doesn't trip on
   the missing function. Single-process test runs can't race themselves.

4. tests/test_news_window.py seeded Headline rows without `fingerprint`,
   which is NOT NULL — added an `fp-{title}` value per row.

5. tests/test_email_digest_job.py now also patches `llm_configured` to
   True so the job doesn't short-circuit on the missing API key.

6. (test container hygiene) Drop `COPY tests ./tests` from the test stage
   in the Dockerfile — .dockerignore excludes `tests/` (correct: prod
   image must not bake tests), and docker-compose.test.yml bind-mounts
   ./tests at run time anyway.

Suite now: 198 passed, 5 skipped, 1 pre-existing failure
(test_default_groups_present — Phase G dropped the "pie" group from
config/default.toml but the assertion wasn't updated; unrelated to this
branch).

app/routers/api.py

@@ -37,6 +37,7 @@ from app.models import (
     JobRun,
     Quote,
     StrategicLog,
+    User,
 )
 from app.schemas import (
     HealthOut,
@@ -837,7 +838,14 @@ async def patch_digest_prefs(
     if principal.user is None:
         # Admin bearer-token path — no per-user row to persist to.
         raise HTTPException(status_code=400, detail="no_user_context")
-    principal.user.email_digest_opt_in = payload.opt_in
-    principal.user.digest_tone = payload.tone
+    # require_token loads `principal.user` in its own short-lived session.
+    # By the time this handler runs, that session is closed; mutating the
+    # detached object and committing via `session` would persist nothing.
+    # Re-fetch in the active session before writing.
+    user = await session.get(User, principal.user.id)
+    if user is None:
+        raise HTTPException(status_code=404, detail="user_not_found")
+    user.email_digest_opt_in = payload.opt_in
+    user.digest_tone = payload.tone
     await session.commit()
     return DigestPrefsOut(opt_in=payload.opt_in, tone=payload.tone)