chore: reorganize test files into domain-specific subdirectories under tests/

Split the monolithic test directory into three tiers (unit, api, e2e) with a path-mirroring directory structure. Added corresponding Makefile targets (test-unit, test-api, test-e2e) and updated all documentation references (CLAUDE.md, README.md, testing-cicd.html, testing-framework.html, testing-make.html) to reflect the new layout and naming conventions.

tests/api/profile/regenerateapikey.py

@@ -0,0 +1,51 @@
+# retoor <retoor@molodetz.nl>
+
+import base64
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+_counter_api_auth = [0]
+def _signup_api_auth(password="secret123"):
+    _counter_api_auth[0] += 1
+    name = f"apiauth{int(time.time() * 1000)}{_counter_api_auth[0]}"
+    email = f"{name}@t.dev"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": email,
+            "password": password,
+            "confirm_password": password,
+        },
+        allow_redirects=True,
+    )
+    return session, name, email, password
+def _user_api_auth(name):
+    return get_table("users").find_one(username=name)
+def _key_api_auth(name):
+    return _user_api_auth(name)["api_key"]
+
+
+def test_regenerate_invalidates_old_key(app_server):
+    session, name, _, _ = _signup_api_auth()
+    old_key = _key_api_auth(name)
+    _, target, _, _ = _signup_api_auth()
+
+    resp = session.post(f"{BASE_URL}/profile/regenerate-api-key")
+    new_key = resp.json()["api_key"]
+    assert new_key != old_key
+
+    old = requests.post(
+        f"{BASE_URL}/follow/{target}",
+        headers={"X-API-KEY": old_key},
+        allow_redirects=False,
+    )
+    assert old.status_code == 401
+    new = requests.post(
+        f"{BASE_URL}/follow/{target}",
+        headers={"X-API-KEY": new_key},
+        allow_redirects=False,
+    )
+    assert new.status_code in (302, 200)