test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

- CI: add a 'test' job running the unit suite via config/vitest.ci.config.ts. Excludes browser (Playwright/chromium) and perf tests (timing-flaky), like the existing test/mobile suite. Safe in CI: TmuxManager no-ops shell commands under VITEST (test/setup.ts).
- Add scripts/check-frontend-syntax.mjs (node --check on src/web/public/*.js), wired into the lint job — catches a class of frontend SyntaxError that passes lint today (lint globs only TS).
- Add test/security-regression.test.ts (wired Host/Origin guard, self-update CSRF, CSP/security headers, text/plain raw body, WS anti-CSWSH) + test/sse-registry-parity.test.ts (backend<->frontend SSE registry parity).
- Green pre-existing test debt surfaced by the new gate: stale 'Session not found' asserts -> 'not found' substring; drop tests for removed helpers (isError now internal; createSuccessResponse deleted); file-stream-manager: mock realpathSync + fix stale /tmp assertion; sse-subscription-filter: lifecycle events broadcast to all clients (only terminal stream filtered); session.test.ts: mkdir /tmp/test; skip one interactive-respawn test needing a real PTY (covered by respawn-controller.test.ts).
- Full non-mobile suite verified green locally (2680 passed, 12 skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/types.test.ts

@@ -13,7 +13,6 @@ import {
   createInitialState,
   ApiErrorCode,
   DEFAULT_CONFIG,
-  isError,
   getErrorMessage,
 } from '../src/types.js';
 
@@ -265,33 +264,8 @@ describe('types utility functions', () => {
     });
   });
 
-  describe('isError', () => {
-    it('should return true for Error instances', () => {
-      expect(isError(new Error('test'))).toBe(true);
-      expect(isError(new TypeError('test'))).toBe(true);
-      expect(isError(new RangeError('test'))).toBe(true);
-      expect(isError(new SyntaxError('test'))).toBe(true);
-    });
-
-    it('should return false for non-Error values', () => {
-      expect(isError('error string')).toBe(false);
-      expect(isError(123)).toBe(false);
-      expect(isError(null)).toBe(false);
-      expect(isError(undefined)).toBe(false);
-      expect(isError({})).toBe(false);
-      expect(isError({ message: 'fake error' })).toBe(false);
-    });
-
-    it('should return false for arrays', () => {
-      expect(isError([])).toBe(false);
-      expect(isError([new Error('test')])).toBe(false);
-    });
-
-    it('should return false for functions', () => {
-      expect(isError(() => {})).toBe(false);
-      expect(isError(Error)).toBe(false);
-    });
-  });
+  // (isError is now an internal helper in src/types/api.ts — no longer a public
+  // export; it is covered indirectly via getErrorMessage below.)
 
   describe('getErrorMessage', () => {
     it('should extract message from Error objects', () => {
@@ -359,7 +333,12 @@ describe('types utility functions', () => {
 
     describe('TaskStatus', () => {
       it('should support all status values', () => {
-        const statuses: Array<'pending' | 'running' | 'completed' | 'failed'> = ['pending', 'running', 'completed', 'failed'];
+        const statuses: Array<'pending' | 'running' | 'completed' | 'failed'> = [
+          'pending',
+          'running',
+          'completed',
+          'failed',
+        ];
         expect(statuses).toHaveLength(4);
       });
     });