Testing, CI, and tooling gaps from the round 3 audit #392

Testing, CI, and tooling gaps found in the round 3 audit. These are process/quality rather than runtime bugs, grouped into one issue.

Lint / tooling

• ESLint uses tseslint.configs.recommended, not recommended-type-checked, so the type-aware rules are off. no-floating-promises, no-misused-promises, and await-thenable never run, which in an axios + React app is the class of bug most likely to slip (a forgotten await on a service call passes lint clean).
• The i18n no-literal-string gate runs in jsx-text-only mode, so hardcoded strings in placeholder=/title=/aria-label= and in JS (toasts, throw new Error(...)) bypass it. Nothing runs i18n:extract in CI, so the az locale can drift out of sync.
• tsconfig doesn't enable noUncheckedIndexedAccess (already noted) given the heavy array indexing.

CI / hooks

• root-ci.yml (fires on root-only changes) runs config checks + npm ci --ignore-scripts but never go test, go vet, or the web build.
• There is no web test runner at all (no vitest/jest/testing-library, no test files), so the entire React app is untested. ui-ci runs lint/format/build only.
• Neither govulncheck nor npm audit runs in CI. (npm audit currently flags one low-severity dev-only esbuild advisory via vite.)
• Husky pre-commit skips go test/go vet for migration-only changes, so a migration that breaks the testcontainer schema isn't caught until CI/pre-push.

Test coverage

• internal/crypto (the AES-GCM layer that encrypts OAuth secrets, SMTP passwords, GitHub App keys) has zero tests, including the two silent-failure fall-throughs (Encrypt returns plaintext when the key is unset; DecryptOrPlain swallows errors and returns "").
• internal/auth/service_test.go runs on a hand-maintained SQLite schema instead of the real migrations, so it can drift from production Postgres.
• Down-migrations are never exercised by any test.
• Progress/count math is only tested on the empty case (cycle/epic progress tests never seed a mix and check the completed tally); 14 handler tests assert via require.Contains(body, ...) substrings that pass on incidental matches.

Deps

• @tiptap/extension-mention and @tiptap/suggestion use caret ^3.22.3 while the other 22 @tiptap/* are pinned exact; a future npm update can float them and cause the silent peer-dep mismatch CLAUDE.md warns about. (Also tracked in the round 1 cluster Round 2 audit: lower-severity correctness, contract and tooling items #349.)