test: add Vitest unit tests + CI workflow, fix angular-eslint v22 config

[cunla]

What & why

This branch gives the app its first unit tests and a working test harness, plus a GitHub Actions workflow that gates PRs on lint + tests. It also fixes a pnpm lint regression introduced by a recent angular-eslint 21→22 bump.

Test harness: Karma → Vitest

The repo had pnpm test wired to Karma but it couldn't run — no test packages were installed, karma.conf.js/test.ts were stale (referenced the old @angular-devkit/build-angular plugin + outdated zone.js/dist/zone-testing path), and there's no browser available. Switched to @angular/build:unit-test with the Vitest runner, which runs headless in Node/jsdom — no browser needed in CI.

• Added a dedicated app:build:test build configuration with zone.js + zone.js/testing polyfills. The default config triggered a top-level-await failure in Angular's generated test-bed init; the static zone import avoids it. Production build is untouched.
• Added vitest + jsdom; removed stale karma.conf.js and test.ts; cleaned up tsconfig.spec.json.
• Added .browserslistrc (standard Angular matrix). The project had none, so browserslist fell back to defaults (Opera Mini/KaiOS) — those lack TLA and made the prod build needlessly target dead browsers.

Tests — 32, all passing

Spec	Coverage
events.service.spec.ts	pub/sub, multi-handler fan-out, error isolation (throwing handler doesn't stop others), all unsubscribe branches
readingdb.service.spec.ts	day-read via EVENT_FINISHED_READING, note add/remove, toggleFavorite direction (union vs remove), userDocValue → EMPTY when logged out, login/logout re-pointing, ngOnDestroy, and writes are no-ops when logged out
material.service.spec.ts	TestBed + HTTP testing for load + caching

TextSelectDirective was intentionally skipped — it relies on Selection/Range geometry that jsdom implements poorly.

Lint fix (regression)

angular-eslint v22 removed .configs.recommended from the @angular-eslint/* plugins (presets moved to the angular-eslint meta-package), which broke pnpm lint with Cannot read properties of undefined (reading 'recommended'). Rewrote eslint.config.mjs to the canonical v22 flat-config stack (angular-eslint + typescript-eslint meta-packages), preserving the project's deliberate overrides (prefer-standalone/prefer-inject off, no-explicit-any as warning).

CI

.github/workflows/ci.yml runs on PRs to master: checkout → pnpm → Node 22 → install → lint/format check → unit tests (lint gates tests). Concurrency cancels superseded runs.

Reviewer notes

• Formatting gate = ESLint, not Prettier. Prettier is installed but the codebase isn't Prettier-formatted, and src/assets/** (static reading HTML) breaks its parser — a prettier --check gate would fail CI repo-wide. ESLint is the project's real style/lint gate. Happy to add a scoped Prettier check + format pass if wanted.
• Local verification: pnpm lint (0 errors, only tracked no-explicit-any warnings), pnpm exec ng test --watch=false (32 pass), ionic build --prod all green.

---

Dependabot CVE fixes (added)

Also resolves the 9 open Dependabot alerts (4 high, 3 moderate, 2 low) on the default branch. All are transitive deps, so they're pinned via pnpm-workspace.yaml overrides (pnpm 11 ignores package.json overrides).

Bumped existing pins:

Package	Was	Now (resolved)
protobufjs	^7.5.8	^7.6.3 (7.6.4)
@grpc/grpc-js	^1.9.15	^1.9.16 (1.14.4)
tar	^7.5.11	^7.5.16 (7.5.16)

New pins:

Package	Pin	Scope
vite	^7.3.5	dev server / vitest
esbuild	^0.28.1	bundler
@babel/core	^7.29.6 (7.29.7)	build

The esbuild/vite bumps touch the build toolchain, so verified the full pipeline stays green: pnpm lint (0 errors), 32 unit tests, prod build, and dev server (HTTP 200).