Test suite (Vitest) + GitHub Actions CI

Test suite (proof-of-work/tests/)
- vitest 4 + @vitest/coverage-v8 added as devDeps. New scripts: test,
  test:watch, test:coverage.
- vitest.config.ts: single-fork pool so DB-backed tests don't trample
  each other on temp file paths. `@/` alias mirrors tsconfig.
- tests/helpers/db.ts: setupTestDb() spins up a fresh schema-only
  SQLite file per test suite via `prisma db push --skip-generate`,
  returns a scoped PrismaClient + cleanup that removes WAL/SHM
  sidecars too.
- tests/rateLimit.test.ts: under-limit / over-limit / per-key
  isolation / window-slides-and-allows-again. Plus tests for
  clientIpFromHeaders header preference order.
- tests/auth-pure.test.ts: hashPassword roundtrips, salt-randomness
  (same input, different hash), bcrypt format ($2 prefix).
- tests/library.test.ts: actually runs the runtime
  ensureExerciseLibrary.cjs against a temp DB with two users — verifies
  the full library lands for every user, idempotent across two runs,
  and a user's own custom exercise with a colliding name is NOT
  overwritten on subsequent ensure passes. This is the highest-stakes
  test in the suite (covers the exact code path that runs on every
  container boot).

12 tests, ~1.0s total.

GitHub Actions CI (.github/workflows/ci.yml)
- Two jobs running in parallel on push + PR to master/main:
  - `app`: cd proof-of-work && npm ci && prisma validate && prisma
    generate && tsc --noEmit && npm test
  - `startos`: cd start9/0.4 && npm ci && npm run check (the
    StartOS package's existing tsc --noEmit script)
- Both jobs use Node 20 with npm cache keyed off the package-lock.

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+    branches: [master, main]
+
+jobs:
+  app:
+    name: proof-of-work (Next.js app)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: proof-of-work
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: proof-of-work/package-lock.json
+      - run: npm ci
+      - name: Prisma validate
+        run: npx prisma validate
+      - name: Prisma generate
+        run: npx prisma generate
+      - name: Type-check
+        run: npx tsc --noEmit
+      - name: Tests
+        run: npm test
+
+  startos:
+    name: start9/0.4 (StartOS package code)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: start9/0.4
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: start9/0.4/package-lock.json
+      - run: npm ci
+      - name: Type-check StartOS package source
+        run: npm run check