test: cover the constraint checks, workspace store, and webmcp tools

[usehoplite]

What

Adds the project's first tests for the untested src/ production modules, focused on the riskiest behavior. Everything runs through npm test via Node's native TypeScript type stripping (no new test framework or dependency), and npm run build / npm run lint stay clean.

Coverage

• src/worksheet.test.ts (58 tests) — the four constraint checks that the product's "4/4 — Ready for class" contract depends on (checkTimeEstimate, checkReadingLevel, checkQuestionMix, checkStandardCoverage, evaluateConstraints), source analysis (fraction/decimals parsing, comparison detection, GCD, transcript vs topic fallback), draft generation (math generator gating, standards intersection), and the prompt/instruction-leak guards (assertQuestionContent, normalizeQuestionChanges, generateReplacementQuestion).
• src/workspaceStore.test.ts (38 tests) — state transitions (addSourceMaterial remote-URL/image rejection, editQuestion, reorder/delete, constraints validation), the Gemini success path and the documented local-fallback path of generateDraft/swapQuestion (fetch-stubbed), runAgentInstruction routing, and hydrate hardening against malformed or stale persisted payloads.
• src/webmcp.test.ts (17 tests) — agent-facing tool handlers: input rejection of untrusted payloads, fallback generation through the handler, the read-only check_* tools over "current" and explicit worksheets, and the registerClassworkTools lifecycle (nine tools, ready status, abort-on-dispose, unsupported browsers).
• server/index.test.mjs — unchanged; npm test now runs both suites (120 tests total).

Production changes (small, deliberate)

• Instruction-leak guard (src/worksheet.ts): \bquestion\b → \bquestions?\b so leaked phrasing like "Create 3 questions..." no longer slips past the guard that is meant to fail closed. Verified against every prompt the app itself generates.
• Import specifiers in src/workspaceStore.ts and src/webmcp.ts now use explicit .ts extensions (already allowed by tsconfig.app.json) so the modules load under Node's native type stripping.
• Config: tsconfig.app.json adds node to types (tests live in src); package.json test script includes src/*.test.ts; docs/TESTING.md documents the Node 23.6+ requirement.

Verification

npm test   → 120 tests, 0 failures (was 7 server-only tests)
npm run lint   → 0 warnings, 0 errors
npm run build  → tsc -b && vite build succeed