test: pin the delivery callback, JWT, and audience opt-out

[cursor]

Coverage for recently merged production paths that shipped without tests, or whose tests never ran in CI.

Risky behavior now covered

• Delivery confirmation (POST /api/responses/delivered): unset/empty callback token fails closed (503, not "no auth"); bearer mismatch including length mismatch is 401 without throwing; traversal-shaped session ids are 400; the UPDATE is write-once (pdf_delivered_at IS NULL) so a re-send cannot restart the shred clock.
• Key-box callback (notifyDelivered): a 404 is logged rather than treated as success — the failure that left pdf_delivered_at unset for months; a network miss cannot fail a send that already happened.
• Key-box push (pushBundle): unconfigured / non-2xx / network failure all become a contentless KeyboxUnavailableError, so a log line cannot carry the questionnaire.
• Questionnaire JWT: round-trip carries the email hash, never the address; tamper, wrong secret, expiry, and missing JWT_SECRET fail closed; the secret is read per call (the boot-order trap).
• Audience middleware: /api/health and /api/metrics are not visitors; GPC and DNT opt out; counting cannot change the response.
• Shared utilities: Gmail normalisation and suspicious-pattern rejection; question-order invariants (gate questions stay out of a post-gate shuffle); HMAC key non-extractability; funnel index mapping.

Test files added/updated

• routes/api/responses/delivered_test.ts (new)
• romania/tests/callback_test.ts (new)
• lib/romania-client_test.ts (new)
• lib/jwt_test.ts (new)
• routes/_middleware_test.ts (new)
• lib/emailValidator_test.ts (new)
• lib/questionnaire_test.ts (new)
• lib/crypto_test.ts (new)
• lib/metrics_test.ts (new)
• .github/workflows/ci.yml — these suites, plus existing lib/audience_test.ts, lib/client-ip_test.ts, lib/qr-scans_test.ts, and romania/tests/, now run on the check job.

Tiny production changes only where tests required them: KEYBOX_RENDER_* and RENDER_CALLBACK_* are read on each call (same boot-order trap lib/jwt.ts already documents), and notifyDelivered is exported. No delivery, auth, or counting behavior otherwise changes.

Why this reduces regression risk

The callback route existed to stamp delivery and start the shred clock; without tests, a 404 or an unset token could (and did) look like success. JWT verification is the resume capability: an expiry skip or an address in the payload would be a privacy and auth break with no other alarm. Audience middleware claims "bookkeeping cannot change what a visitor receives" and honours GPC/DNT — those were untested request-path contracts. CI was not running the lib/romania suites that already existed, so they could not have stopped a repeat.

Hermetic: no Postgres, no SMTP, no live key box. fetch is stubbed. 184 passed locally on the expanded CI command (12 romania PDF tests ignored where typst/qpdf are absent).