[Testing 05] test: minimal vitest harness for backend and frontend

[amal66]

Summary

The minimal vitest harness from the reference index (#205, row amal66#24): a test script and vitest dev-dependency in both backend/ and frontend/, with one seed suite per package. This is the base of a small testing series — every other test PR in the series rides on it.

Changes

• backend/package.json / frontend/package.json — "test": "vitest run" + vitest ^4.1.9 dev-dependency; lockfiles regenerated against current main.
• backend/tsconfig.json — excludes *.test.ts / __tests__/ from the production tsc build.
• Seed suites: backend/src/lib/__tests__/downloadTokens.test.ts (12 tests) and frontend/src/app/lib/utils.test.ts (8 tests).

Why

The repo has no test runner today, so no PR can carry tests. This adds the smallest possible harness — dev-deps only, no config beyond the tsconfig exclude, no CI coupling — so subsequent PRs (and community PRs) can add suites incrementally.

Testing

• npm test --prefix backend — 12/12 passing.
• npm test --prefix frontend — 8/8 passing.
• npm run build --prefix backend — passes (test files excluded from the build).

Relationship to other open PRs

• [Security 11] Server-side hardening pack  #227 (security pack) folds this same harness in as its first commit; whichever merges first, the other rebases to a no-op. Kept standalone here so the testing series doesn't depend on the security review.
• Follow-up PRs in this series (unit tests, integration tests, frontend component tests, evals, CI, contributor docs) each base on this branch; until they can be stacked properly (Graphite, needs write access), they include this commit — review only their top commit.

🤖 Generated with Claude Code