[TEST-001] Add core product test suite

[chev0004]

Outline

Summary

Adds the core product test suite on bun test: 38 tests covering session cookie security, logged-out route guards through the real middleware, discovery search and sort behavior, profile and settings form validation, bump cooldowns, and localized language labels, plus a GitHub Actions workflow that runs checks and tests on every pull request.

---

Changes & Enhancements

• Type of Change:
  • Feature
  • Bugfix
  • Refactor
  • Chore
• Changes:
  • (Tests):
    • auth-session: sign and verify round trip, tampered payload and signature rejection, expiry, missing-secret behavior.
    • middleware: logged-out and invalid-session visitors are redirected off profile, settings, and onboarding; valid sessions pass; public routes are unguarded.
    • discoverySearch/discoverySort: search across names, localized language names, interests, and bio in en and ja; bump ordering, name ordering, input immutability.
    • Profile/schema and Settings/schema: required fields, caps, duplicates, and localized error message keys.
    • bumpProfile: free and premium cooldown math and boundaries.
    • constants/languages: localized labels per locale, passthrough, sorting, code validation.
  • (Tooling):
    • Add bun test script and @types/bun so tests typecheck.
    • Add .github/workflows/tests.yml running bun run check:all and bun test on pull requests and pushes to develop and main.

---

Page / App Changes

Affected Next.js Routes (Local):

Before (Screenshot)

After (Screenshot)

---

Component / Storybook Changes

Affected Storybook Components (Local):

Before (Screenshot)

After (Screenshot)

---

Not Doing

• Database-backed integration tests: the suite deliberately avoids a DB dependency so it runs anywhere; API-with-database coverage needs a test database decision first.

---

Other (Remarks)

---

Checklists

• Code is well-documented (comments, JSDoc, etc.).
• Existing comments were updated as needed.
• No out-of-scope changes are included.
• Write TODO comments where future work is required.
• Removed unnecessary debug code (e.g., console.log, debugger).
• Self-reviewed and tested locally.