ci: run the database-backed suites and drop coverage from the unit step

The cover-letter and MCP OAuth flow suites were gated on environment variables
CI never set, so they never ran. Point them at the job's PostgreSQL. The
cover-letter suite works in its own schema; the OAuth suite gets a database of
its own because it writes signing keys under its own secret, which the e2e
server can't decrypt.

Nothing reads the unit step's coverage report, so test:ci no longer collects it.

packages/api/package.json

@@ -20,7 +20,7 @@
 		"typecheck": "tsgo --noEmit",
 		"test": "vitest run --passWithNoTests",
 		"test:coverage": "vitest run --coverage --passWithNoTests",
-		"test:ci": "vitest run --coverage --reporter=default --reporter=github-actions --reporter=json --reporter=junit --outputFile.json=reports/vitest-results.json --outputFile.junit=reports/vitest-junit.xml --passWithNoTests",
+		"test:ci": "vitest run --reporter=default --reporter=github-actions --reporter=json --reporter=junit --outputFile.json=reports/vitest-results.json --outputFile.junit=reports/vitest-junit.xml --passWithNoTests",
 		"test:agent": "vitest run --reporter=agent --reporter=json --outputFile.json=reports/vitest-results.json --passWithNoTests"
 	},
 	"dependencies": {

packages/api/turbo.json

@@ -1,4 +1,13 @@
 {
 	"extends": ["//"],
-	"tags": ["runtime:server", "role:api"]
+	"tags": ["runtime:server", "role:api"],
+	"tasks": {
+		"test": { "env": ["COVER_LETTER_TEST_DATABASE_URL"] },
+		"test:coverage": { "env": ["COVER_LETTER_TEST_DATABASE_URL"] },
+		"test:agent": { "env": ["COVER_LETTER_TEST_DATABASE_URL"] },
+		"test:ci": {
+			"cache": false,
+			"env": ["COVER_LETTER_TEST_DATABASE_URL"]
+		}
+	}
 }