test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

- CI: add a 'test' job running the unit suite via config/vitest.ci.config.ts. Excludes browser (Playwright/chromium) and perf tests (timing-flaky), like the existing test/mobile suite. Safe in CI: TmuxManager no-ops shell commands under VITEST (test/setup.ts).
- Add scripts/check-frontend-syntax.mjs (node --check on src/web/public/*.js), wired into the lint job — catches a class of frontend SyntaxError that passes lint today (lint globs only TS).
- Add test/security-regression.test.ts (wired Host/Origin guard, self-update CSRF, CSP/security headers, text/plain raw body, WS anti-CSWSH) + test/sse-registry-parity.test.ts (backend<->frontend SSE registry parity).
- Green pre-existing test debt surfaced by the new gate: stale 'Session not found' asserts -> 'not found' substring; drop tests for removed helpers (isError now internal; createSuccessResponse deleted); file-stream-manager: mock realpathSync + fix stale /tmp assertion; sse-subscription-filter: lifecycle events broadcast to all clients (only terminal stream filtered); session.test.ts: mkdir /tmp/test; skip one interactive-respawn test needing a real PTY (covered by respawn-controller.test.ts).
- Full non-mobile suite verified green locally (2680 passed, 12 skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/integration-flows.test.ts

@@ -165,7 +165,7 @@ describe('Integration Flows', () => {
       createdSessions.push(quickStartData.sessionId);
 
       // Wait for Claude to start up
-      await new Promise(resolve => setTimeout(resolve, 2000));
+      await new Promise((resolve) => setTimeout(resolve, 2000));
 
       // Send input
       const inputRes = await fetch(`${baseUrl}/api/sessions/${quickStartData.sessionId}/input`, {
@@ -177,7 +177,7 @@ describe('Integration Flows', () => {
       expect(inputData.success).toBe(true);
 
       // Wait for response
-      await new Promise(resolve => setTimeout(resolve, 1000));
+      await new Promise((resolve) => setTimeout(resolve, 1000));
 
       // Check terminal buffer has content
       const terminalRes = await fetch(`${baseUrl}/api/sessions/${quickStartData.sessionId}/terminal`);
@@ -234,7 +234,7 @@ describe('Integration Flows', () => {
       // Verify session is gone
       const verifyRes = await fetch(`${baseUrl}/api/sessions/${quickStartData.sessionId}`);
       const verifyData = await verifyRes.json();
-      expect(verifyData.error).toBe('Session not found');
+      expect(verifyData.error).toContain('not found');
     });
   });
 
@@ -309,7 +309,7 @@ describe('SSE Event Flow', () => {
 
     const fetchPromise = fetch(`${baseUrl}/api/events`, {
       signal: controller.signal,
-    }).then(async response => {
+    }).then(async (response) => {
       const reader = response.body?.getReader();
       if (reader) {
         try {
@@ -331,7 +331,7 @@ describe('SSE Event Flow', () => {
     });
 
     // Wait for connection
-    await new Promise(resolve => setTimeout(resolve, 100));
+    await new Promise((resolve) => setTimeout(resolve, 100));
 
     // Perform quick start
     const quickStartRes = await fetch(`${baseUrl}/api/quick-start`, {
@@ -344,11 +344,13 @@ describe('SSE Event Flow', () => {
     createdSessions.push(quickStartData.sessionId);
 
     // Wait for events
-    await new Promise(resolve => setTimeout(resolve, 500));
+    await new Promise((resolve) => setTimeout(resolve, 500));
 
     // Stop SSE
     controller.abort();
-    try { await fetchPromise; } catch {}
+    try {
+      await fetchPromise;
+    } catch {}
 
     // Verify expected events were received
     expect(receivedEvents).toContain('init');