Adds vitest with 36 tests covering the security primitives:
- lib/auth: token gen uniqueness, hashToken determinism, JWT roundtrip,
validateAdminSecret bearer flow, getClientIp x-forwarded-for parsing
- lib/admin-auth: bcrypt hash uniqueness/verify, JWT roundtrip,
audience claim isolation (admin JWT does not validate as investor JWT)
- lib/rate-limit: limit enforcement, key isolation, window reset via
fake timers, preset config sanity
Pure-function coverage only — route handler integration tests would
need a test DB and are deferred.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
