test(unit): add a unit-test layer (backend cargo + frontend vitest)

The suite was almost entirely e2e; pure logic had no direct coverage. Add fast,
DB-free unit tests on both sides.

Backend (cargo test — inline #[cfg(test)] modules):
- rate_limiter: allow-up-to-max-then-block, per-key independence, sliding-window
  expiry, retry-after bounds, clear(), and client_ip X-Forwarded-For parsing
  (first entry / whitespace-trim / fallback).
- sse_tickets: single-use consume (replay → None), unknown ticket, uniqueness +
  hex shape, prune keeps fresh tickets, and an expired ticket (injected past-TTL
  entry) consumes to None.
- hashtag: fill the boundary gaps the 3 existing tests missed — stop-at-non-word,
  the 40-char cap (drops, doesn't truncate), no-dedup contract, and the German
  umlaut truncation limitation (pinned so a future Unicode fix is deliberate).

Frontend (Vitest — new, standalone config that stubs $app/environment so
server-safe module paths import cleanly under node):
- avatar: avatarPalette (neutral for empty, deterministic, real palette entry) and
  initials (?, single word, two words, whitespace collapse).
- data-mode-store: pickMediaUrl across original/saver modes and the
  preview→thumbnail→original fallback chain.
- `npm run test:unit` script added.

Backend: 20 passing. Frontend: 11 passing. svelte-check: 0 errors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/avatar.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect } from 'vitest';
+import { avatarPalette, initials } from './avatar';
+
+describe('avatarPalette', () => {
+  it('returns the neutral palette for empty / nullish names', () => {
+    expect(avatarPalette(null)).toContain('bg-gray-100');
+    expect(avatarPalette(undefined)).toContain('bg-gray-100');
+    expect(avatarPalette('')).toContain('bg-gray-100');
+  });
+
+  it('is deterministic for the same name', () => {
+    expect(avatarPalette('Alice')).toBe(avatarPalette('Alice'));
+  });
+
+  it('returns a real palette entry (not neutral) for a non-empty name', () => {
+    expect(avatarPalette('Bob')).toMatch(/bg-(blue|purple|green|amber|rose|teal)-100/);
+  });
+});
+
+describe('initials', () => {
+  it('returns "?" for empty / nullish / whitespace-only names', () => {
+    expect(initials(null)).toBe('?');
+    expect(initials(undefined)).toBe('?');
+    expect(initials('')).toBe('?');
+    expect(initials('   ')).toBe('?');
+  });
+
+  it('uses the first letter (uppercased) for a single word', () => {
+    expect(initials('alice')).toBe('A');
+  });
+
+  it('uses the first letters of the first two words', () => {
+    expect(initials('Alice Bob Carol')).toBe('AB');
+  });
+
+  it('collapses runs of whitespace between words', () => {
+    expect(initials('  john   doe ')).toBe('JD');
+  });
+});

frontend/src/lib/data-mode-store.test.ts

@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest';
+import { pickMediaUrl } from './data-mode-store';
+
+const upload = {
+  id: 'abc-123',
+  preview_url: '/media/previews/p.jpg',
+  thumbnail_url: '/media/thumbnails/t.jpg',
+};
+
+describe('pickMediaUrl', () => {
+  it('original mode → the original API route, ignoring preview/thumbnail', () => {
+    expect(pickMediaUrl('original', upload)).toBe('/api/v1/upload/abc-123/original');
+  });
+
+  it('saver mode → preview_url when present', () => {
+    expect(pickMediaUrl('saver', upload)).toBe('/media/previews/p.jpg');
+  });
+
+  it('saver mode → thumbnail_url when preview is null', () => {
+    expect(pickMediaUrl('saver', { ...upload, preview_url: null })).toBe('/media/thumbnails/t.jpg');
+  });
+
+  it('saver mode → original route when both preview and thumbnail are null', () => {
+    expect(pickMediaUrl('saver', { id: 'x', preview_url: null, thumbnail_url: null })).toBe(
+      '/api/v1/upload/x/original'
+    );
+  });
+});

frontend/src/test/mocks/app-environment.ts

@@ -0,0 +1,7 @@
+// Test stub for SvelteKit's `$app/environment` virtual module (which only exists
+// during dev/build). `browser: false` makes modules like data-mode-store take their
+// server-safe path (no localStorage access) when imported under Vitest's node env.
+export const browser = false;
+export const dev = false;
+export const building = false;
+export const version = 'test';