[RakshithBhat03]

The project had four small parsing tests. This adds a suite covering every module, two bug fixes the tests turned up, and CI to run it.

Tests (70, about 1.5s)

None of them use the network, a real browser, or ~/.portmap. Probes and the HTTP API run against real sockets on ephemeral loopback ports. Thumbnail capture uses a stub "browser" shell script, and persistence uses throwaway directories. Shared fixtures are in src/testutil.rs.

• scan: parsing of lsof/ps output, runtime/system/desktop-app classification, project detection on a temp directory tree, and HTTP probing (titles, redirects, non-HTTP listeners, address fallback, closed ports).
• store: entry classification and state, persistence round-trip (transient fields not saved), orphan thumbnail sweep, expiry rules, view versioning and name fallback.
• scanner: port filtering, probe caching (re-probes on restart, return, and force), stale→removed transitions, thumbnail scheduling (preference, hidden, failure backoff), batching of refresh requests.
• server: Host and Origin/CSRF guards, every action, the end-to-end API (static assets, 304 polling, scanner wake-up, /api/refresh waiting for a scan, thumbnail serving).
• thumbs: capture through a stub browser including the real sips JPEG conversion on macOS, failure backoff, skipped work.
• launchd: plist rendering and escaping. main: --port parsing.

Refactors

These pull pure logic out of subprocess and socket code so it can be tested: parse_listeners/parse_ps_args/parse_cwds, scanner relevant/update/run_with, server serve/host_allowed/mutation_allowed, plist(), and parse_args(). Behavior is unchanged, except that a malformed lsof line starting with a multi-byte character is now skipped instead of panicking.

Bug fixes found by the tests

• probe() reported a server with 3 or more chained redirects as non-HTTP, so it showed up under "other" instead of as a card. The last hop's response is now reported as-is.
• The thumbnail worker ignored hidden. A service hidden while queued, or during a capture, got a screenshot anyway, which brought back the thumbnail that hiding had just deleted.

Verification

• cargo test passed 10 times in a row locally. Clippy (-D warnings) and cargo fmt --check are clean.
• I checked that the redirect test, the hidden-thumbnail tests, and the refresh-wait test each fail when their fix or behavior is reverted.
• GPT-6.1-Sol (Codex, medium) ran two independent review rounds. Its round-1 findings are addressed here, and round 2 recommended merging.

Known follow-up (not in this PR)

A scan saves state.json only when the visible view changes, so last_seen for a long-running, unchanged service isn't persisted. If portmap restarts abruptly and the service is gone by then, its bookmark is cleared immediately instead of after the stale TTL. Fixing this needs periodic state writes, which is a separate design decision.