test: update vitest for CVE & add CI test workflow

[baileydunning]

Summary

Bumps vitest off a critically vulnerable version and adds a GitHub Actions workflow to run the integration test suite on every push/PR.

Security fix

• Updated vitest and @vitest/coverage-v8 from 4.0.18 → 4.1.8, resolving GHSA-5xrq-8626-4rwp (critical — the Vitest UI server can read and execute arbitrary files; affects all vitest <4.1.0).
• npm audit fix also bumped a transitive qs (6.15.1 → 6.15.2), clearing a moderate DoS advisory (GHSA-q8mj-m7cp-5q26).
• npm audit now reports 0 vulnerabilities.

CI

• New .github/workflows/test.yaml runs on push/PR to main and manual dispatch.
• Installs Harper via the existing install_harper.sh, runs npm install, starts the component with harperdb run ., polls the REST interface on :9926 until ready, then runs npm test. Dumps Harper logs on failure.
• Sets USE_STATIC_ONLY=false so the regex-redirect tests are exercised.

[gemini-code-assist]

Code Review

This pull request updates the development dependencies in package.json and package-lock.json, specifically upgrading @vitest/coverage-v8 and vitest from version 4.0.18 to 4.1.8. This upgrade triggers several cascading dependency updates in the lockfile, including upgrading vite to version 8.0.16, replacing rollup with rolldown, and introducing lightningcss. There are no review comments to evaluate, and I have no additional feedback to provide on these dependency updates.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.