test(unit): add a unit-test layer (backend cargo + frontend vitest)

The suite was almost entirely e2e; pure logic had no direct coverage. Add fast,
DB-free unit tests on both sides.

Backend (cargo test — inline #[cfg(test)] modules):
- rate_limiter: allow-up-to-max-then-block, per-key independence, sliding-window
  expiry, retry-after bounds, clear(), and client_ip X-Forwarded-For parsing
  (first entry / whitespace-trim / fallback).
- sse_tickets: single-use consume (replay → None), unknown ticket, uniqueness +
  hex shape, prune keeps fresh tickets, and an expired ticket (injected past-TTL
  entry) consumes to None.
- hashtag: fill the boundary gaps the 3 existing tests missed — stop-at-non-word,
  the 40-char cap (drops, doesn't truncate), no-dedup contract, and the German
  umlaut truncation limitation (pinned so a future Unicode fix is deliberate).

Frontend (Vitest — new, standalone config that stubs $app/environment so
server-safe module paths import cleanly under node):
- avatar: avatarPalette (neutral for empty, deterministic, real palette entry) and
  initials (?, single word, two words, whitespace collapse).
- data-mode-store: pickMediaUrl across original/saver modes and the
  preview→thumbnail→original fallback chain.
- `npm run test:unit` script added.

Backend: 20 passing. Frontend: 11 passing. svelte-check: 0 errors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/models/hashtag.rs

@@ -109,4 +109,38 @@ mod tests {
     fn empty_or_bare_hash_skipped() {
         assert_eq!(extract_hashtags("# #"), Vec::<String>::new());
     }
+
+    #[test]
+    fn tag_stops_at_first_non_word_char() {
+        // A tag runs until the first char that isn't ascii-alphanumeric or '_'.
+        assert_eq!(extract_hashtags("#foo#bar"), vec!["foo"]);
+        assert_eq!(extract_hashtags("#foo-bar"), vec!["foo"]);
+        assert_eq!(extract_hashtags("##tag"), Vec::<String>::new()); // '#' after the strip is non-word
+    }
+
+    #[test]
+    fn tag_length_is_capped_at_40_chars() {
+        let ok = "a".repeat(40);
+        assert_eq!(extract_hashtags(&format!("#{ok}")), vec![ok.clone()]);
+        // 41+ chars → dropped entirely (not truncated).
+        let too_long = "a".repeat(41);
+        assert_eq!(extract_hashtags(&format!("#{too_long}")), Vec::<String>::new());
+    }
+
+    #[test]
+    fn duplicate_tags_are_returned_verbatim_not_deduplicated() {
+        // Dedup is the DB's job (Hashtag::upsert ON CONFLICT); extraction returns each
+        // occurrence so callers can count/link them independently. Case folds to lower.
+        assert_eq!(extract_hashtags("#fun #Fun #fun!"), vec!["fun", "fun", "fun"]);
+    }
+
+    #[test]
+    fn non_ascii_word_chars_truncate_the_tag() {
+        // KNOWN LIMITATION for a German app: `is_ascii_alphanumeric` excludes umlauts
+        // and ß, so a tag truncates at the first non-ASCII letter. Pinned here so a
+        // future Unicode-aware change is a deliberate, test-visible decision.
+        assert_eq!(extract_hashtags("#Grüße"), vec!["gr"]);
+        assert_eq!(extract_hashtags("#Straße"), vec!["stra"]);
+        assert_eq!(extract_hashtags("#café"), vec!["caf"]);
+    }
 }

backend/src/services/rate_limiter.rs

@@ -81,3 +81,74 @@ pub fn client_ip(headers: &axum::http::HeaderMap, fallback: &str) -> String {
         .map(|s| s.trim().to_owned())
         .unwrap_or_else(|| fallback.to_owned())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::http::HeaderMap;
+
+    const MIN: Duration = Duration::from_secs(60);
+
+    #[test]
+    fn allows_up_to_max_then_blocks() {
+        let rl = RateLimiter::new();
+        assert!(rl.check("k", 3, MIN));
+        assert!(rl.check("k", 3, MIN));
+        assert!(rl.check("k", 3, MIN));
+        assert!(!rl.check("k", 3, MIN), "the 4th request must be blocked");
+    }
+
+    #[test]
+    fn keys_are_independent() {
+        let rl = RateLimiter::new();
+        assert!(rl.check("a", 1, MIN));
+        assert!(!rl.check("a", 1, MIN));
+        assert!(rl.check("b", 1, MIN), "a different key has its own window");
+    }
+
+    #[test]
+    fn window_slides_and_allows_again_after_expiry() {
+        let rl = RateLimiter::new();
+        let w = Duration::from_millis(40);
+        assert!(rl.check("k", 1, w));
+        assert!(!rl.check("k", 1, w));
+        std::thread::sleep(Duration::from_millis(55));
+        assert!(rl.check("k", 1, w), "the slot should expire once the window passes");
+    }
+
+    #[test]
+    fn retry_after_is_between_one_and_window() {
+        let rl = RateLimiter::new();
+        assert!(rl.check_with_retry("k", 1, MIN).is_ok());
+        let retry = rl.check_with_retry("k", 1, MIN).unwrap_err();
+        assert!((1..=60).contains(&retry), "retry_after {retry} out of range");
+    }
+
+    #[test]
+    fn clear_resets_every_window() {
+        let rl = RateLimiter::new();
+        assert!(rl.check("k", 1, MIN));
+        assert!(!rl.check("k", 1, MIN));
+        rl.clear();
+        assert!(rl.check("k", 1, MIN), "clear() must free the window");
+    }
+
+    #[test]
+    fn client_ip_prefers_first_forwarded_for_entry() {
+        let mut h = HeaderMap::new();
+        h.insert("x-forwarded-for", "203.0.113.7, 10.0.0.1".parse().unwrap());
+        assert_eq!(client_ip(&h, "fallback"), "203.0.113.7");
+    }
+
+    #[test]
+    fn client_ip_trims_surrounding_whitespace() {
+        let mut h = HeaderMap::new();
+        h.insert("x-forwarded-for", "  198.51.100.5  ".parse().unwrap());
+        assert_eq!(client_ip(&h, "fb"), "198.51.100.5");
+    }
+
+    #[test]
+    fn client_ip_falls_back_when_header_absent() {
+        assert_eq!(client_ip(&HeaderMap::new(), "127.0.0.1"), "127.0.0.1");
+    }
+}

backend/src/services/sse_tickets.rs

@@ -72,3 +72,58 @@ fn random_ticket() -> String {
     rng.fill(&mut bytes);
     bytes.iter().map(|b| format!("{b:02x}")).collect()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn issue_then_consume_returns_the_hash_exactly_once() {
+        let store = SseTicketStore::new();
+        let ticket = store.issue("hash-1".into());
+        assert_eq!(store.consume(&ticket).as_deref(), Some("hash-1"));
+        // Single-use: a replay of the same ticket is rejected.
+        assert_eq!(store.consume(&ticket), None, "a consumed ticket must not be reusable");
+    }
+
+    #[test]
+    fn unknown_ticket_consumes_to_none() {
+        let store = SseTicketStore::new();
+        assert_eq!(store.consume("never-issued"), None);
+    }
+
+    #[test]
+    fn issued_tickets_are_unique_and_hex() {
+        let store = SseTicketStore::new();
+        let a = store.issue("h".into());
+        let b = store.issue("h".into());
+        assert_ne!(a, b, "each ticket must be unique");
+        assert_eq!(a.len(), 48, "24 random bytes → 48 hex chars");
+        assert!(a.chars().all(|c| c.is_ascii_hexdigit()));
+    }
+
+    #[test]
+    fn fresh_ticket_survives_prune() {
+        let store = SseTicketStore::new();
+        let ticket = store.issue("h".into());
+        store.prune(); // not expired → kept
+        assert_eq!(store.consume(&ticket).as_deref(), Some("h"));
+    }
+
+    #[test]
+    fn expired_ticket_consumes_to_none() {
+        // Construct an entry that is already past the TTL and confirm consume() rejects it.
+        let store = SseTicketStore::new();
+        let stale = "stale-ticket".to_string();
+        store.inner.lock().unwrap().insert(
+            stale.clone(),
+            Entry {
+                token_hash: "h".into(),
+                issued_at: Instant::now()
+                    .checked_sub(TTL + Duration::from_secs(1))
+                    .expect("host uptime should exceed the ticket TTL"),
+            },
+        );
+        assert_eq!(store.consume(&stale), None, "an expired ticket must not authenticate");
+    }
+}