Automated test suite, workflow dedup, security…

Details

Architecture-level audit pass. The stack (static Jekyll + framework-free
TypeScript + Python goldens on GitHub Pages) is already the right tool per
layer, so this focuses on the real gaps rather than rewrites.
Tests (new automated suite, run in parallel via .github/workflows/tests.yml):
- run-all.mjs discovers and runs every frontend/client/tests/*.test.mjs suite
  in its own process; wired as `pnpm run test:frontend` and `pnpm test`.
- The existing rigorous EDCR/TPP widget-math suites are now wrapped by npm
  scripts and gated in CI (previously runnable only by hand).
- New weather-service suite: WMO weather-code -> scene mapping + picker labels.
- New db-assets-core suite: HTML escaping, db:// key parsing, content-type
  sniffing, and the new URL-scheme allow-list.
Security hardening (defense-in-depth on Supabase-sourced content):
- Add dbSafeExternalUrl(): parses candidate hrefs through the URL constructor
  and permits only http/https/mailto (relative/anchor stays same-origin),
  collapsing javascript:/data:/vbscript: (incl. control-char obfuscation) to
  '#'. Applied at the db:// link sinks and the publication-list renderer.
Workflows (single source of truth + hardening):
- Extract .github/actions/build-site composite action (Ruby/Node/pnpm + runtime
  config + changelog + Jekyll + tsc); pr-validation, ci, and preview-v3 now call
  it instead of repeating the ~50-line build chain.
- preview-v3 -> a general dispatch-only branch preview (drops the stale v3-branch
  pin now that v3 is the flagship on main).
- prune-documents / seed-sections: add timeout-minutes + a concurrency group and
  bump checkout@v4 -> v6.
Docs / cleanup:
- README: drop the stale PR-#48 "v2 at /" framing (v3 is live at /); add a Tests
  section. CLAUDE.md: document the test scripts, tests.yml, and composite action.
- Fix the stale db_assets.ts path in DATABASE.md; de-contradict the Cursor rule.
- Remove the committed dangling .cursorrules symlink (pointed at an absolute
  machine-only path).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dqq3yLFbZnaCYwTcZZEZRU

Files changed (18)