ci: run the web unit tests

[vineethkrishnan]

Follow-up to #333, which covered the extension. This closes the same class of gap on the web side.

The gap

The web package's 219 vitest tests ran nowhere. ci.yml only built web (npm run build is tsc --noEmit && vite build), and mobile.yml was the only workflow in the repo calling npm test. A failing web unit test could not turn a check red.

It goes further than one missing suite. web/src/shared/crypto/interop-fixtures.test.ts is a generator, not a test: it writes testdata/crypto/*_fixtures.json from the current TypeScript crypto and only asserts a count. The Go interop tests then read those files back:

• internal/domain/crypto/interop_test.go (AES-GCM, HKDF, padding)
• internal/application/clientcrypto/interop_test.go (Argon2id)

With the generator never running in CI, that pair only proved Go could still decrypt fixtures committed from a laptop months ago - not that the two implementations agree today. A change to the TypeScript crypto that broke cross-language compatibility would have gone through green.

The fix

One step, npm test in web, placed ahead of make test. That closes both halves at once: fresh fixtures generated from the current TypeScript, read back by the current Go.

The ordering is load-bearing, so it carries a comment explaining why. Reorder it after make test, or drop it, and the interop tests quietly go back to validating stale committed data.

Verification

Run locally end to end:

web: 31 files, 219 tests passed
testdata/crypto/{aes_gcm,hkdf}_fixtures.json regenerated
go test -run Interop ./internal/domain/crypto/... ./internal/application/clientcrypto/...
  PASS TestInterop_AESGCMDecrypt
  PASS TestInterop_HKDFDerivation
  PASS TestInterop_Padding
  PASS TestInterop_Argon2idDerivation

actionlint clean.

Note

The regenerated fixtures are random per run and dirty the working tree. Harmless here: the only tree check in this job is git diff --exit-code scoped to go.mod / go.sum. It does mean the files show as modified after any local npm test in web, which is pre-existing behaviour and not changed by this PR.