test: isolate workspace secret vaults under vitest

backend/src/app.ts

@@ -1,6 +1,7 @@
 import Fastify, { type FastifyInstance } from "fastify";
 import cors from "@fastify/cors";
 import { join } from "node:path";
+import { tmpdir } from "node:os";
 import type { AppConfig } from "./config.js";
 import { ThtRunner } from "./tht/tht-runner.js";
 import { PiProcessManager } from "./pi/pi-process-manager.js";
@@ -44,9 +45,14 @@ export interface BuildAppDeps {
 
 export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstance {
   const app = Fastify({ logger: { level: "warn" }, disableRequestLogging: true });
+  const isolatedTestRoot = process.env.VITEST === "true"
+    ? join(tmpdir(), `thothii-workspace-secrets-vitest-${process.pid}`)
+    : undefined;
   const workspaceSecretStore = deps?.workspaceSecretStore ?? new WorkspaceSecretStore({
-    root: config.workspaceSecretStoreRoot,
-    runtimeRoot: config.workspaceSecretRuntimeRoot,
+    root: isolatedTestRoot ?? config.workspaceSecretStoreRoot,
+    runtimeRoot: isolatedTestRoot === undefined
+      ? config.workspaceSecretRuntimeRoot
+      : join(isolatedTestRoot, "runtime"),
     installationId: config.workspaceRegistry.installationId,
   });