test(migrations): run integration tests in parallel; harden shared test server

internal/database/postgres/migrations/000053_executions_account_fk_restrict_test.go

@@ -18,6 +18,7 @@ import (
 // purchase_executions.cloud_account_id FK must be ON DELETE RESTRICT after
 // the migration runs. Issue #606 — silent-orphan regression guard.
 func TestMigration_ExecutionsAccountFKRestrict(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
@@ -99,6 +100,7 @@ func TestMigration_ExecutionsAccountFKRestrict(t *testing.T) {
 // emergency rollback re-introduces the (documented) silent-orphan
 // behavior rather than leaving the database in an indeterminate state.
 func TestMigration_ExecutionsAccountFKRestrict_Rollback(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000057_drop_user_role_to_groups_test.go

@@ -39,6 +39,7 @@ func queryGroupIDs(t *testing.T, ctx context.Context, pool *pgxpool.Pool, email
 // no user loses access; guarantees no user can be left with zero groups; and
 // removes the role column from both users and sessions.
 func TestMigration_DropUserRoleToGroups(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
@@ -132,6 +133,7 @@ func assertColumnAbsent(t *testing.T, ctx context.Context, pool *pgxpool.Pool, t
 // TestMigration_DropUserRoleToGroups_Down restores the role column and
 // reconstructs role from group membership.
 func TestMigration_DropUserRoleToGroups_Down(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000060_cleanup_universal_plans_test.go

@@ -33,6 +33,7 @@ import (
 // The down migration is a no-op by design (deleted rows cannot be recovered
 // from SQL alone), so no rollback assertion is made.
 func TestMigration_CleanupUniversalPlans(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000064_relocate_purchaser_group_test.go

@@ -45,10 +45,12 @@ func queryGroupIDsByEmail(t *testing.T, ctx context.Context, pool *pgxpool.Pool,
 // collision with Standard Users (000057), and must backfill all Administrators
 // group members into Purchaser.
 func TestMigration_RelocatePurchaserGroup(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
 	t.Run("Purchaser seeded at new UUID after full migration run", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireMigratedDatabase(ctx, t, migrationsPath)
 		pool := container.DB.Pool()
 
@@ -66,6 +68,7 @@ func TestMigration_RelocatePurchaserGroup(t *testing.T) {
 	})
 
 	t.Run("admin-backfill: Administrators members land in Purchaser", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 
@@ -98,6 +101,7 @@ func TestMigration_RelocatePurchaserGroup(t *testing.T) {
 	})
 
 	t.Run("idempotent: re-running migrations does not duplicate Purchaser membership", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 

internal/database/postgres/migrations/000065_enforce_min_one_admin_test.go

@@ -61,6 +61,7 @@ func countActiveAdmins(t *testing.T, ctx context.Context, pool *pgxpool.Pool) in
 // error string and would pass even if the SQL were wrong), this test runs the
 // actual migration SQL against a real PostgreSQL instance.
 func TestMigration_EnforceMinOneAdmin_ConcurrentRace(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
@@ -142,16 +143,19 @@ func TestMigration_EnforceMinOneAdmin_ConcurrentRace(t *testing.T) {
 	}
 
 	t.Run("concurrent deactivation never removes the last admin", func(t *testing.T) {
+		t.Parallel()
 		commits, remaining := runConcurrentRace(t, `UPDATE users SET active = false WHERE id = $1`)
 		assertRaceSafe(t, commits, remaining, "deactivations")
 	})
 
 	t.Run("concurrent deletion never removes the last admin", func(t *testing.T) {
+		t.Parallel()
 		commits, remaining := runConcurrentRace(t, `DELETE FROM users WHERE id = $1`)
 		assertRaceSafe(t, commits, remaining, "deletions")
 	})
 
 	t.Run("concurrent group removal never removes the last admin", func(t *testing.T) {
+		t.Parallel()
 		commits, remaining := runConcurrentRace(t, `UPDATE users SET group_ids = '{}'::uuid[] WHERE id = $1`)
 		assertRaceSafe(t, commits, remaining, "group removals")
 	})
@@ -163,6 +167,7 @@ func TestMigration_EnforceMinOneAdmin_ConcurrentRace(t *testing.T) {
 // removal that leaves another active admin must succeed. This pins the
 // trigger's COUNT/active semantics against the real migration SQL.
 func TestMigration_EnforceMinOneAdmin_BlocksLastAdminRemoval(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
@@ -176,6 +181,7 @@ func TestMigration_EnforceMinOneAdmin_BlocksLastAdminRemoval(t *testing.T) {
 	}
 
 	t.Run("deactivating the sole admin is rejected", func(t *testing.T) {
+		t.Parallel()
 		pool := freshPool(t)
 		id := seedActiveAdmin(t, ctx, pool, "sole-admin@test.example")
 		require.Equal(t, 1, countActiveAdmins(t, ctx, pool))
@@ -189,6 +195,7 @@ func TestMigration_EnforceMinOneAdmin_BlocksLastAdminRemoval(t *testing.T) {
 	})
 
 	t.Run("deleting the sole admin is rejected", func(t *testing.T) {
+		t.Parallel()
 		pool := freshPool(t)
 		id := seedActiveAdmin(t, ctx, pool, "sole-admin-del@test.example")
 		require.Equal(t, 1, countActiveAdmins(t, ctx, pool))
@@ -202,6 +209,7 @@ func TestMigration_EnforceMinOneAdmin_BlocksLastAdminRemoval(t *testing.T) {
 	})
 
 	t.Run("removing one of two admins succeeds", func(t *testing.T) {
+		t.Parallel()
 		pool := freshPool(t)
 		a := seedActiveAdmin(t, ctx, pool, "two-admins-a@test.example")
 		_ = seedActiveAdmin(t, ctx, pool, "two-admins-b@test.example")

internal/database/postgres/migrations/000078_monthly_summary_nested_rollup_test.go

@@ -32,6 +32,7 @@ import (
 // shape): provider/service total = AVG(250, 400) = 325. The pre-fix flat AVG
 // returned 650/6 = 108.33.
 func TestAnalyticsNestedRollup_COR02(t *testing.T) {
+	t.Parallel()
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
 	defer cancel()
 

internal/database/postgres/migrations/000086_remove_approve_own_from_standard_users_test.go

@@ -38,10 +38,12 @@ func standardUsersHasPurchaseVerb(t *testing.T, ctx context.Context, pool *pgxpo
 // virtue of ownership. The removal must be surgical -- the sibling own-scoped
 // verbs (cancel-own, retry-own) seeded alongside it in 000057 must be retained.
 func TestMigration_RemoveApproveOwnFromStandardUsers(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
 	t.Run("approve-own removed, sibling own-verbs retained", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 
@@ -75,6 +77,7 @@ func TestMigration_RemoveApproveOwnFromStandardUsers(t *testing.T) {
 	})
 
 	t.Run("down migration restores approve-own", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 

internal/database/postgres/migrations/000087_purchase_history_marketplace_listing_test.go

@@ -23,6 +23,7 @@ import (
 // 000087 applied) would fail because the columns do not exist; after 000087 the
 // test passes.
 func TestMigration087_MarketplaceColumns(t *testing.T) {
+	t.Parallel()
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
 	defer cancel()
 

internal/database/postgres/migrations/000088_grant_view_config_to_nonadmin_groups_test.go

@@ -38,10 +38,12 @@ func groupHasPermission(t *testing.T, ctx context.Context, pool *pgxpool.Pool, g
 // 403 for those groups. The grant must be surgical: no other permissions are
 // touched on either group, and the write-gating verb (update:config) is not added.
 func TestMigration_GrantViewConfigToNonAdminGroups(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
 	t.Run("view:config granted to Standard Users and Read-Only Users", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 
@@ -66,6 +68,7 @@ func TestMigration_GrantViewConfigToNonAdminGroups(t *testing.T) {
 	})
 
 	t.Run("update:config is NOT granted (write gate is unaffected)", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 
@@ -79,6 +82,7 @@ func TestMigration_GrantViewConfigToNonAdminGroups(t *testing.T) {
 	})
 
 	t.Run("sibling permissions on Standard Users are preserved", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 
@@ -102,6 +106,7 @@ func TestMigration_GrantViewConfigToNonAdminGroups(t *testing.T) {
 	})
 
 	t.Run("down migration removes view:config from both groups", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 
@@ -126,6 +131,7 @@ func TestMigration_GrantViewConfigToNonAdminGroups(t *testing.T) {
 	})
 
 	t.Run("idempotent: applying to a group already holding view:config is safe", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 

internal/database/postgres/migrations/000089_rename_cancelled_to_canceled_test.go

@@ -47,6 +47,7 @@ const (
 //
 //nolint:misspell // test body deliberately exercises the legacy British DB spelling under test -- see migration 000089
 func TestMigration_000089_RollbackWithCanceledRows(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
@@ -164,6 +165,7 @@ func TestMigration_000089_RollbackWithCanceledRows(t *testing.T) {
 //
 //nolint:misspell // test body deliberately exercises the legacy British DB spelling under test -- see migration 000089
 func TestMigration_000089_UpIsAdditiveAndDualCompatible(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000093_recommendations_state_owner_id_test.go

@@ -18,6 +18,7 @@ import (
 // column (issue #261's compare-and-clear guard), and the down migration
 // removes it cleanly.
 func TestMigration_RecommendationsStateOwnerID(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000095_purchase_history_account_id_width_test.go

@@ -106,6 +106,7 @@ func accountIDMaxLength(ctx context.Context, t *testing.T, pool *pgxpool.Pool) i
 // 22001, which is precisely how the audit row for an already-billed commitment
 // is lost. After 000095 both succeed and round-trip untruncated.
 func TestMigration095_PurchaseHistoryAccountIDWidth(t *testing.T) {
+	t.Parallel()
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
 	defer cancel()
 
@@ -194,6 +195,7 @@ func TestMigration095_PurchaseHistoryAccountIDWidth(t *testing.T) {
 // must actually happen. Without this the ALTER branch after the guard is never
 // executed by any test and a typo in it would ship green.
 func TestMigration095_DownNarrowsWhenSafe(t *testing.T) {
+	t.Parallel()
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
 	defer cancel()
 
@@ -229,6 +231,7 @@ func TestMigration095_DownNarrowsWhenSafe(t *testing.T) {
 // VARCHAR(20) with an Azure subscription GUID present would destroy the audit
 // trail this table exists to provide, so the down migration must refuse.
 func TestMigration095_DownRefusesToTruncate(t *testing.T) {
+	t.Parallel()
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
 	defer cancel()
 

internal/database/postgres/migrations/000096_seed_ri_exchanger_group_test.go

@@ -31,10 +31,12 @@ const riExchangerGroupIDTest = "00000000-0000-5000-8000-000000000008"
 // (#942), by running ON CONFLICT DO NOTHING onto an already-occupied UUID.
 // These assertions exist so that failure is loud.
 func TestMigration_SeedRIExchangerGroup(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
 	t.Run("RI Exchanger seeded, system-managed, granting execute:ri-exchange", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireMigratedDatabase(ctx, t, migrationsPath)
 		pool := container.DB.Pool()
 
@@ -70,6 +72,7 @@ func TestMigration_SeedRIExchangerGroup(t *testing.T) {
 	})
 
 	t.Run("admin-backfill: Administrators members land in RI Exchanger", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireEmptyDatabase(ctx, t)
 		pool := container.DB.Pool()
 
@@ -98,6 +101,7 @@ func TestMigration_SeedRIExchangerGroup(t *testing.T) {
 	})
 
 	t.Run("backfill is idempotent and leaves no duplicate entry", func(t *testing.T) {
+		t.Parallel()
 		container := testhelpers.RequireMigratedDatabase(ctx, t, migrationsPath)
 		pool := container.DB.Pool()
 

internal/database/postgres/migrations/000098_backfill_execution_step_number_test.go

@@ -57,6 +57,7 @@ func stepNumberOf(ctx context.Context, t *testing.T, pool *pgxpool.Pool, execID
 // steps) are retargeted at the step they will actually complete, while
 // correctly-stamped rows and terminal rows are left alone.
 func TestMigration_BackfillExecutionStepNumber(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000099_user_deactivated_at_test.go

@@ -51,6 +51,7 @@ func deactivatedAtOf(ctx context.Context, t *testing.T, pool *pgxpool.Pool, user
 // could self-reactivate via password reset regardless of how it went
 // inactive.
 func TestMigration_UserDeactivatedAtBackfill(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000100_hash_approval_tokens_at_rest_test.go

@@ -112,6 +112,7 @@ func runUpSQL(ctx context.Context, t *testing.T, pool *pgxpool.Pool, migrationsP
 // destroying migrated hashes; and the no-op down keeps the hashes so a
 // down-then-up is lossless.
 func TestMigration_HashApprovalTokensAtRest(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 
@@ -184,6 +185,7 @@ func TestMigration_HashApprovalTokensAtRest(t *testing.T) {
 // or execution history, pending lists and the scheduler break. A row the new
 // store writes must also stay readable by pre-#103 code.
 func TestMigration_HashApprovalTokensAtRest_StoreReadsTokenlessRows(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000102_purchase_plan_update_token_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func TestMigration_PurchasePlanUpdateToken(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	path := getMigrationsPath()
 	container := testhelpers.RequireMigratedDatabase(ctx, t, path)

internal/database/postgres/migrations/000103_api_key_password_version_test.go

@@ -12,6 +12,7 @@ import (
 )
 
 func TestMigration_APIKeyPasswordVersion(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	path := getMigrationsPath()
 	container := testhelpers.RequireMigratedDatabase(ctx, t, path)

internal/database/postgres/migrations/000104_user_mfa_last_totp_counter_test.go

@@ -15,6 +15,7 @@ import (
 // Migration 000104 adds users.mfa_last_totp_counter. Existing rows start at 0
 // (no code accepted yet), and the down migration removes the column.
 func TestMigration_UserMFALastTOTPCounter(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000105_purchase_history_listing_attempt_test.go

@@ -17,6 +17,7 @@ import (
 // purchase_history: existing rows have no unresolved attempt, and the down
 // migration removes both columns.
 func TestMigration_PurchaseHistoryListingAttempt(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000106_invalidate_azure_recs_lookback_units_test.go

@@ -16,6 +16,7 @@ import (
 )
 
 func TestMigration_InvalidateAzureRecsLookbackUnits(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	path := getMigrationsPath()
 	container := testhelpers.RequireEmptyDatabase(ctx, t)

internal/database/postgres/migrations/000107_ladder_tranche_amendments_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func TestMigration_LadderTrancheAmendments(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	path := getMigrationsPath()
 	container := testhelpers.RequireEmptyDatabase(ctx, t)
@@ -87,6 +88,7 @@ func TestMigration_LadderTrancheAmendments(t *testing.T) {
 }
 
 func TestMigration_LadderTrancheAmendmentsRollbackWhenEmpty(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	path := getMigrationsPath()
 	container := testhelpers.RequireEmptyDatabase(ctx, t)

internal/database/postgres/migrations/000109_recommendations_availability_zone_test.go

@@ -26,6 +26,7 @@ const insertRecForMigration109 = `
 // both payload shapes, the 8-column index is kept so the current upsert still
 // works, and rollback removes the column and the new index.
 func TestMigration_RecommendationsAvailabilityZone(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000110_drop_recommendations_8col_natural_key_test.go

@@ -25,6 +25,7 @@ const insertRecForMigration110 = `
 // the 8-column index is gone, the 9-column index still dedupes per AZ, and the
 // rollback recreates the 8-column index after collapsing AZ-only duplicates.
 func TestMigration_DropRecommendations8ColNaturalKey(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()
 

internal/database/postgres/migrations/000111_recommendations_platform_tenancy_test.go

@@ -27,6 +27,7 @@ const insertRecForMigration111 = `
 // upsert still works, the 11-column index is added, and rollback removes only
 // the new column pair and index.
 func TestMigration_RecommendationsPlatformTenancy(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	migrationsPath := getMigrationsPath()