test(frontend): Sprint 14 — Vitest for useOnboarding (Q4)

Lifts the 'no new npm deps' rule for testing-only. Locks the
S9 bug class (onComplete → reset, the original bug from
1562929) with 7 unit tests in 25 ms.

5 changes:
- frontend/package.json — 4 new devDeps: vitest@^1.6.0,
  happy-dom@^14.7.0, @testing-library/react@^14.2.0,
  @testing-library/jest-dom@^6.4.0. Plus @types/node@^20
  for tsc (Case 7's static check on App.tsx uses node:fs).
- frontend/package.json scripts — adds 'test' (vitest run,
  no watch, CI-friendly) and 'test:watch' (vitest).
- frontend/vitest.config.ts (NEW) — defineConfig from
  vitest/config, happy-dom env, setupFiles points to
  vitest-setup.ts, include is src/**/*.test.{ts,tsx}.
- frontend/vitest-setup.ts (NEW) — one line: imports
  @testing-library/jest-dom/vitest, auto-extends expect.
- frontend/src/components/OnboardingTour.test.tsx (NEW) —
  7 cases:
  1. clean init (localStorage empty) → isComplete=false.
  2. persisted init (key = '1') → isComplete=true.
  3. markComplete → state=true, localStorage STAYS at '1'
     (locks one direction of the S9 bug at the hook level).
  4. reset → localStorage cleared + state=false.
  5. show → mirror of reset (intentional).
  6. localStorage throw on read → silently swallowed,
     isComplete=false, no crash.
  7. App.tsx wiring — static check: onComplete calls
     markComplete, onReset calls reset, neither inverts.
     Case 7 is the load-bearing test: Sprint 9's bug was
     at the App.tsx call site, not in the hook, so Cases
     1-6 cannot catch it. Case 7 reads App.tsx as a string
     via node:fs/promises, regex-matches the arrow bodies
     of onComplete={...} and onReset={...}, asserts each
     calls the right onboarding.* method.

Verified: flipping markComplete → reset in App.tsx makes
Case 7 fail on the onCompleteBody.toMatch(/markComplete/)
assertion. All 7 cases pass in 25 ms. npm run build green
(tsc 0 errors, vite built in 2.6 s, bundle 503.82 kB
unchanged — vitest is devDeps only). No backend change.
No migration. No runtime dep change.

Deploy: git pull + cd frontend && npm install && npm test
(confirm 7/7) + cd .. && docker compose up -d --build
frontend. No backend rebuild.

frontend/package.json

@@ -7,7 +7,9 @@
     "dev": "vite",
     "build": "tsc && vite build",
     "preview": "vite preview",
-    "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0"
+    "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
+    "test": "vitest run --reporter=default",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@hello-pangea/dnd": "^18.0.1",
@@ -23,14 +25,19 @@
     "tailwind-merge": "^3.6.0"
   },
   "devDependencies": {
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^14.3.1",
+    "@types/node": "^20.19.42",
     "@types/react": "^18.2.48",
     "@types/react-dom": "^18.2.18",
     "@vitejs/plugin-react": "^4.2.1",
     "autoprefixer": "^10.4.16",
     "eslint": "^8.56.0",
+    "happy-dom": "^14.12.3",
     "postcss": "^8.4.33",
     "tailwindcss": "^3.4.1",
     "typescript": "^5.3.3",
-    "vite": "^5.0.11"
+    "vite": "^5.0.11",
+    "vitest": "^1.6.1"
   }
 }