chore: add vitest + first unit tests (prompt-sanitize, town-code, town/events)

[omjeem]

Summary

Adds a test runner to the repo (there is currently no test framework configured and no test script in any package) and a first suite of 61 unit tests for three pure, security-relevant modules in apps/web.

Test setup - mirrored from RedPlanetHQ/core

The configuration intentionally replicates the testing environment of the main RedPlanetHQ/core repo so both projects stay consistent:

• Vitest ^3.2.0 + vite-tsconfig-paths ^4.2.1 - the same two packages and versions core's apps/webapp uses.
• apps/web/vitest.config.ts is a mirror of core's apps/webapp/vitest.config.ts: tsconfigPaths() plugin, environment: "node", with the include pattern adapted from their app/**source root to this app's src/**/*.test.ts(x).
• "test": "vitest run" script in the app's package.json, same as core.
• Same file conventions as core: __tests__/ folders colocated with source, files named <module>.test.ts.
• Like core, there is no root-level test script or turbo test task - the runner lives in the app package only.

Tests added

Suite	Tests	Covers
src/lib/__tests__/prompt-sanitize.test.ts	16	Speaker:-line injection stripping in safeBlock, newline flattening in safeInline, C0/DEL control-char removal, all reserved-label variants, length caps
src/lib/__tests__/town-code.test.ts	22	slug normalization + validation (reserved slugs, length bounds, hyphen rules), share-code charset (Crockford base32, no I/L/O/U), code normalization, malformed visitor cookie → null for every field
src/lib/town/__tests__/events.test.ts	23	signBody against a hardcoded known-answer HMAC vector, verifyHmac (tampered body, wrong secret, wrong length, invalid hex), full parseEnvelope validation for both event types

Notes:

• @town/db is mocked in the events suite (it instantiates PrismaClient at import time); the functions under test never touch it, so the suite runs with no database or generated client.
• Tests document actual current behavior, including two subtleties: safeBlock replaces \r with a space before line-splitting (CRLF → " \n"), and topic-field validation errors don't include the array path in the message.

How to run

pnpm --filter @town/web test

[harshithmullapudi]

hey @omjeem can you rebase this branch with the main

[omjeem]

Rebased on latest main and pushed 👍 Tests + typecheck green.