#11071 test: fix the 7 suites failing the full unit run (stage ddf2899f1c)

Fixes the 7 suites that fail the full unit run test-unit.yml 39088001294 on stage @ ddf2899f1c (equal to develop at the time). Nothing on develop had fixed any of them since.

Only test files change. No test is removed or skipped, and no assertion is changed or weakened. No product bug was found. Item 7 looked like a route regression, but it was the spec's token.

#	Failing suite	Cause	Fix
1	core integration-tenant.update.handler.spec.ts:82,95 TS2493	commandBus.execute was jest.fn(async () => []), so mock.calls is typed [][] and mock.calls[0][0] does not compile	The double declares the command it receives: jest.fn(async (_command: unknown) => [])
2	plugin-entitlement write-routes.spec.ts:1766 TS2493	Same problem on entitlement.extend.mock.calls[1][1]	jest.fn(async (..._args: unknown[]) => …)
3	plugin-cart commerce-cart.service.spec.ts:3070 TS2345	The shipping port's calculate(optionId, context) now takes the rate query, but the fixture double still declared (id), so a case's two-argument mockImplementation did not fit	The double takes (id, _context), matching ICartShippingPort.calculate
4	plugin-catalog collection.service.spec.ts:695 TS2339	The concurrent-move case inferred its table from collectionRow() (which has no parentId key), then set parentId on a row	The table is typed ITables, the same way collectionFixture types its own
5	plugin-payment payment-account-holder.controller.spec.ts TypeError: VisibleWith is not a function	The suite loads the account-holder resolver, whose methodTokens field now has @VisibleWith (#10880). The spec's @gauzy/core double had no such export	Uses the real decorator (jest.requireActual('@gauzy/core/src/lib/api/visible-with.decorator')), as payment-instrument.resolver.spec.ts does. It only writes metadata
6	plugin-payment refund.service.spec.ts:1800 TS2540	The no-row-lock case assigned the read-only dataSource.options.type	datastore(), refundFixture() and order() now take the dialect when they are built (default postgres, unchanged for every other case). The case builds its fixture with better-sqlite3
7	plugin-auth-zitadel zitadel-token.e2e.spec.ts:52: expected body.code to be email_unverified, got undefined	A spec bug, not a route regression. The case overrode aud: 'teams-web' but kept the mock issuer's default azp, which is this product's own web client (gauzy-web-test) and is not in ZITADEL_ALLOWED_AUDIENCES. The shared OIDC client's authorized-party check (assertAuthorizedParty) refuses that token with a bare 401 before ZitadelSigninService.decide() ever reads email_verified. The "this product's own web client" case pins exactly that refusal. The route itself still throws UnauthorizedException({ code: 'email_unverified' }) (#11016), and the HTTP layer passes code through: the id_token_required case in the same file passes	The case states azp: 'teams-web', the same claims as the accepted workspace-list case, so it reaches the sign-in decision and pins the coded 401

Verification

• test-unit.yml has no project filter (it only takes a parallel input and runs nx run-many -t test over everything), so it is verified with one full workflow_dispatch run on this branch. Run: 39125253395 on 881d39c5ea (in progress; a full run takes 3 to 4.5 h).
• No local run: there is no working install on this machine.

🤖 Generated with Claude Code