tests: add Vitest coverage + cross-platform throwaway-Neo4j wrappers

[stevepridemore]

Summary

Adds Vitest test coverage measurement with cross-platform wrapper scripts that handle the throwaway-Neo4j container, so a developer can run npm run test:coverage:local and get accurate numbers locally that match what CI computes.

Changes

• New devDep: @vitest/coverage-v8 (faster than istanbul, no source instrumentation)
• vitest.config.ts: coverage block — v8 provider, text + html reporters, sensible exclude list. No thresholds (measure first, decide later).
• Three new npm scripts:
  • test:coverage — assumes NEO4J_* env set; CI uses this
  • test:local — wrapper-driven full suite, no coverage
  • test:coverage:local — wrapper-driven full suite with coverage (the primary local command)
• scripts/test-with-neo4j.{sh,ps1}: spin up neo4j:5.20-community on :7689 with NEO4J_AUTH=neo4j/test1234, wait for readiness via cypher-shell polling (60 s cap), run vitest with forwarded args, guarantee teardown via trap/finally. Idempotent (removes leftover container at start).
• CI: Test job now runs npm run test:coverage against its existing service container — coverage numbers are real, not artificially lowered by Neo4j-test failures.
• docs/TESTING.md: new Coverage section. Test-suite table refreshed to include oauth-events.test.ts and read-body.test.ts (added in OAuth event logging (closes R-1, I-3) #17 and Cap readBody to 64 KB / 4 MB by route (closes D-3) #24); suite-size phrasing made non-numeric so the doc doesn't drift again.
• vitest.config.ts also excludes .claude/** from test discovery — caught during verification when an agent worktree under .claude/ caused duplicate test discovery. Project-level fix unrelated to coverage.

Baseline coverage

Captured on this branch (133 tests across 4 files):

File	% Stmts	% Lines
oauth-events.ts	100	100
oauth.ts	82	84
read-body.ts	80	81
embeddings.ts	71	74
config.ts	72	72
neo4j-client.ts	57	60
Project	65	67

Best covered: oauth-events.ts, oauth.ts, read-body.ts — recent test discipline pays off. Largest gap: neo4j-client.ts (57%) — fault-injection paths (Cypher errors, transaction rollbacks, connection failures) not unit-tested.

Test plan

• npm run build clean
• npm run test:coverage:local runs end-to-end on Windows (Git Bash) — 133 passing, container torn down on exit
• No personal paths/emails/domains in any of the new artifacts (verified with grep)
• CI runs npm run test:coverage against service container and prints coverage summary in the Test job log
• PowerShell wrapper exercised on a clean Windows shell where bash isn't on PATH

Out of scope

• Coverage threshold enforcement — deferred. Pick a baseline-aware threshold once we've watched the number for a couple of cycles.
• Codecov / Coveralls integration — not worth it for a single-user repo today; HTML report locally is enough.
• Coverage artifact upload from CI — text summary in logs is sufficient.

🤖 Generated with Claude Code