test(web): add an honest minimal test gate

[Jeremy1844]

Audit root

• Audit ID: ADV-2026-0034 / RC-0034
• Base: e1ae76a87809fa5f30cec9640458c83691d4be05
• Head: 48237f4d0c9f4b1d5f21eb262271fc058656aefa
• Scope: one commit, one root, 7 isolated test/workflow files

Why

PR #24's testing stack can remain green at roughly 3% coverage. Its obsolete threshold shape, filtered accessibility findings, and nonnegative assertions do not enforce the quality boundary they appear to provide. The audited base has no coverage command at all.

This draft intentionally supersedes only #24's test-infrastructure slice. It does not replace that PR's unrelated product or deployment changes.

Minimal replacement

• Add an isolated, lock-bound tests/ package.
• Test two existing Pinia stores with 13 behavior assertions.
• Require explicit 100% coverage for only those two declared production files.
• Independently reject empty or omitted required-file coverage.
• Run a read-only, secret-free, bounded workflow with immutable action commits.
• Keep the legacy frozen production install/build separate and unchanged.

No src/, public/, root manifest/lock, content, persistence, deployment, or runtime behavior changes are included.

Regression evidence

• Expected RED: the audited base has no test:coverage command.
• PASS: isolated npm ci --ignore-scripts, 81 packages, audit zero.
• PASS: 13/13 tests; 100% statements, branches, functions, and lines.
• PASS: independent verifier confirms nonempty coverage for both required files.
• Expected failure: a temporary 101% line threshold exits 1.
• Expected failure: omitting language.js still displays 100% for the remaining file, then the independent verifier exits 1.
• PASS: Yarn 1.22.22 frozen install and unchanged production build, 1,221 modules.
• PASS: exact diff, policy, ancestry, and clean-worktree checks.

The published commit uses the account's GitHub noreply identity while preserving the tested tree, parent, message, dates, and stable patch ID.

Existing PR overlap

#24 and its inherited infrastructure commit in #25-#30 conflict in .github/workflows/test.yml; maintainers should retain only separately reviewed functional tips and rebase them after this foundation. #16, #32, #33, and #34 have no exact file overlap with this root. No existing PR should be closed automatically from this draft.

Keep this PR in draft until first-time-fork approval, both hosted Ubuntu jobs, controlled hosted failure injection, log/privacy review, and maintainer approval pass. No merge, release, deployment, or required-check change is authorized by local evidence.