Establish test scaffolding across sample apps (currently zero tests)

[jhamon]

Theme: Testing + CI Foundation

Problem

None of the four apps has any automated tests (only tsconfig.json files exist; namespace-notes/server's test script is a placeholder that exits 1). With no tests, the dependency-major and SDK-upgrade work (#74) cannot be proven safe beyond build success.

Proposed fix

Add a light but real test layer per app, fitting each stack:

• namespace-notes/server (highest value — holds the security-sensitive storage/controller logic from Resolve 13 open code-scanning alerts in namespace-notes (path-injection, SSRF, rate-limiting) #72): unit tests for the path-confinement guard and controllers; mock S3/network; API-layer tests with supertest.
• Next.js apps (legal-semantic-search, pinecone-assistant, namespace-notes/client): component/util unit tests with Testing Library + a test runner (vitest/jest); mock external calls with msw.
• shop-the-look FastAPI backend: pytest with the Starlette/httpx test client; mock Pinecone and Google auth.
• Live/credentialed Pinecone tests (if any) must self-skip when the API key is absent and use uniquely-named throwaway resources.
• Wire the test steps into the CI matrix from Add CI: GitHub Actions matrix (lint + typecheck + build) over all sample apps #71 once they exist.

Acceptance criteria

• Each app has at least a smoke-level test suite that runs green locally and in CI without credentials (external services mocked).
• CI (Add CI: GitHub Actions matrix (lint + typecheck + build) over all sample apps #71) invokes the tests per app.

Blast radius

safe — additive test code only.

Dependencies

Depends on #71 (CI matrix to run the tests). Complements #72 (server security fixes get regression coverage).