test(#411): add missing test coverage — getAccessToken, isAdmin, null cases, getClientIp

- Add getAccessToken tests (5): null session, valid token, expired token, buffer window, undefined token
- Add isAdmin tests (4): null session, true, false, undefined
- Add getUserById/getUserByEmail null-return tests (2)
- Add getClientIp tests via handleAuth (4): single IP, comma-separated, array, fallback
- Fix pre-existing controller spec failure by adding better-auth vi.mock calls

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.service.spec.ts

@@ -89,6 +89,23 @@ describe("AuthService", () => {
         },
       });
     });
+
+    it("should return null when user is not found", async () => {
+      mockPrismaService.user.findUnique.mockResolvedValue(null);
+
+      const result = await service.getUserById("nonexistent-id");
+
+      expect(result).toBeNull();
+      expect(mockPrismaService.user.findUnique).toHaveBeenCalledWith({
+        where: { id: "nonexistent-id" },
+        select: {
+          id: true,
+          email: true,
+          name: true,
+          authProviderId: true,
+        },
+      });
+    });
   });
 
   describe("getUserByEmail", () => {
@@ -115,6 +132,23 @@ describe("AuthService", () => {
         },
       });
     });
+
+    it("should return null when user is not found", async () => {
+      mockPrismaService.user.findUnique.mockResolvedValue(null);
+
+      const result = await service.getUserByEmail("unknown@example.com");
+
+      expect(result).toBeNull();
+      expect(mockPrismaService.user.findUnique).toHaveBeenCalledWith({
+        where: { email: "unknown@example.com" },
+        select: {
+          id: true,
+          email: true,
+          name: true,
+          authProviderId: true,
+        },
+      });
+    });
   });
 
   describe("isOidcProviderReachable", () => {