test(web): vitest suites for markdown, filters, password rules, api, storage, toast

Test infrastructure uses the vite-plus stack: vp test (bundled Vitest 5),
jsdom environment configured in vite.config.ts, colocated web/src/*.test.ts
files that tsc type-checks, vp fmt formats, and the bundler never imports.

- markdown.test.ts pins the notes XSS defenses: parser-level html escaping,
  DOMPurify FORBID_TAGS, scheme checks, footnote rendering, html->markdown
  round-trips incl. the headingless-table rule.
- filter_builder.test.ts pins the deep-link wire contract (ruleToFlatParam),
  smart-serialization rules (isFlatable), and pruneIncomplete semantics.
- password_validation.test.ts covers the rules fetch + fallback and the
  full submit-gating matrix through the real DOM flow (debounce included).
- api.test.ts pins response/error contracts incl. the HTTP-status and
  Unknown-error fallbacks and the 404-as-null progress contract.
- storage.test.ts covers token/theme/library round-trips, the __all__
  sentinel, and the SSR cookie.
- toast.test.ts pins config completeness for every ToastType (the missing
  'warning' entry regression) and render behavior.

Found + fixed while writing these: the no-useless-escape fix in
d7d14957 had de-escaped the ']' in hasSpecialChar's character class,
closing it early — special-character validation silently stopped
matching most specials. The new password suite caught it immediately.

jsdom chosen over happy-dom after empirical comparison: DOMPurify's
sanitizer output is mangled under happy-dom (forbidden tags survive),
which would have made the security suite test nothing.

Note: AGENTS.md gains a 'Web (TypeScript) tests' section documenting the
workflow and the happy-dom gotcha.

AGENTS.md

@@ -113,6 +113,23 @@ were name-only across ALL libraries. Fixed; do not regress.
   tested with synthetic ffprobeReport values. Recipes:
   docs/contributing/development.md → Media fixtures.
 
+## Web (TypeScript) tests
+
+- `npm run test` (vp test) runs the vitest suite: colocated `web/src/*.test.ts`
+  files, jsdom environment (configured in vite.config.ts `test`). Do NOT switch
+  to happy-dom — DOMPurify's sanitizer output is mangled under it, which makes
+  the markdown security suite test nothing (verified empirically; jsdom is the
+  documented fallback for exactly this reason).
+- Static gates: `npx tsc --noEmit`, `npx vp check web/src` (format + lint),
+  `npx vp fmt web/src` to apply formatting.
+- Tests are never bundled (build entries are main.ts/reader.ts only). When
+  touching build config, re-prove it: back-to-back `npm run build:ts` runs must
+  produce byte-identical hashes, and no test-only strings may appear in
+  web/static.
+- markdown.test.ts pins the notes XSS defenses (FORBID_TAGS, scheme checks,
+  parser-level html escaping). Loosening any assertion there is a security
+  decision, not cleanup.
+
 ## Timezones
 
 - The server owns display conversion: clients send instants (RFC3339),