test(cron): cover send-alerts route end-to-end

[eliottreich]

Adds behavior tests for the send-alerts cron route (apps/web/app/api/cron/send-alerts/route.ts). Scoped to that one route, matching the co-located mocking style of the existing sync-news and validate-cameras cron tests. No production code is changed; this is a single new test file.

Refs #20.

Note: the issue mentions zero cron-route tests, but the repo already has tests for sync-news and validate-cameras. This PR follows their patterns rather than introducing new shared abstractions, and focuses on send-alerts.

Behaviors protected

• Unauthorized requests return 401 and send nothing (admin client is never constructed)
• No subscribers returns the zero-send no_subscribers response
• No recent incidents returns the zero-send no_recent_incidents response
• Severity thresholds select only incidents at or above each subscription's threshold
• Neighborhood filters select the correct incidents
• Previously sent subscription/incident pairs are not resent (dedup)
• Successful sends persist a sent record and update last_sent_at
• Failed sends persist a failed record and surface the error in the response
• The 50-email per-run cap is enforced
• Returned sent / subscribers / incidents counters are correct

Assertions are on real outputs (response bodies, the persisted alert_sends rows, alert_subscriptions update patches, and actual recipient/subject selection), not just that mocks were called. Time is frozen via fake timers; Supabase and the email sender are mocked at their boundaries.

Verification

• Full suite goes from 105 to 115 passing tests (10 new), nothing else changed.
• The new tests passed three consecutive runs (no flakiness observed).
• Typecheck is clean.
• Controlled-break check: temporarily disabling the dedup logic made the dedup test fail; temporarily disabling the neighborhood filter made the neighborhood-selection and counters tests fail. Both breaks were reverted, leaving the route unchanged.

Lint note

Repo-wide lint could not be run: the repository currently has no functional ESLint configuration (next lint drops into the interactive "configure ESLint" setup on a clean checkout). I did not change the lint configuration in this PR. Flagging it in case it is useful to address separately.

[NewCoder3294]

Reviewed for safety/security and test impact. This is test-only, mocks external boundaries, does not change runtime code or secrets handling, and the relevant test/typecheck commands pass locally. Non-blocking: consider changing Closes #20 to Refs #20 if #20 should keep tracking remaining cron-route coverage.

[eliottreich]

Thanks for the review. I changed the reference from Closes #20 to Refs #20 so the parent issue can continue tracking the remaining cron routes. The PR is ready to merge when convenient.