test: minimal vitest harness for backend and frontend

[amal66]

Summary

Upstream currently has no test runner at all — backend/package.json carries only dev/build/start scripts and frontend/ has none either. This adds the smallest possible vitest harness to both packages (a dev-dependency, a test script, and one unit test each of existing pure functions) so that future changes can carry regression tests.

Changes

• backend/package.json: add "test": "vitest run" script and vitest@^4.1.9 devDependency
• backend/tsconfig.json: exclude src/**/*.test.ts and src/**/__tests__/** so tests never reach dist/ (tsc build output unchanged)
• backend/src/lib/__tests__/downloadTokens.test.ts: unit tests for signDownload / verifyDownload / buildDownloadUrl (round-trip, tampered payload/signature, malformed tokens, wrong secret, URL embedding)
• frontend/package.json: add "test": "vitest run" script and vitest@^4.1.9 devDependency
• frontend/src/app/lib/utils.test.ts: unit tests for cn, diceCoefficient, isFuzzyMatch
• backend/package-lock.json, frontend/package-lock.json: regenerated via npm install --save-dev vitest@4.1.9 (never hand-edited)

No vitest config files are needed — vitest picks up *.test.ts zero-config. No jsdom or testing-library; both suites test pure functions only.

Why

A safety net for large sync bursts: with even a minimal harness in place, any future PR can land with tests instead of establishing infrastructure first. Dev-dependencies only — zero runtime cost, zero hosting cost, no CI workflow changes, no eslint changes.

Testing

• cd backend && npm install && npm test — 1 file, 12 tests passed (vitest 4.1.9)
• cd backend && npm run build — tsc passes; verified dist/ contains no test files
• cd frontend && npm install && npm test — 1 file, 8 tests passed (vitest 4.1.9)
• Frontend next build not run (only test files and dev-dependencies changed)

Provenance

All changes are mechanical ports of code in amal66/mike@origin/main (commit b3166dd); exceptions: none.

• "test": "vitest run" script: verbatim from apps/api/package.json and apps/web/package.json
• vitest@^4.1.9: range declared in apps/web/package.json; 4.1.9 is the exact version resolved in the fork's lockfile (apps/api declares ^4.1.7, which also resolves to 4.1.9 there)
• tsconfig exclude entries: verbatim from apps/api/tsconfig.json
• frontend/src/app/lib/utils.test.ts: byte-identical copy of apps/web/src/app/lib/utils.test.ts
• backend/src/lib/__tests__/downloadTokens.test.ts: strict subset of apps/api/src/lib/__tests__/downloadTokens.test.ts (zero added lines); the fork-only core/downloadTokens import and its "token expiry" suite are dropped because that module does not exist upstream
• lockfile diffs: npm-generated; residual churn is npm reconciling the pre-existing lockfiles during install

🤖 Generated with Claude Code

https://claude.ai/code/session_01CEguyEgXa9JjCciXCcVemC

[amal66]

Superseded by #227, which folds this into a single server-side security-hardening pack (with the vitest harness so its tests run standalone — 57 backend + 8 frontend tests green).