audit week 3 [TEST-001]: bootstrap vitest + utils & configSchema smoke tests

Adds vitest@^4.1.5 as a devDependency, an `npm test` script (runs once,
non-watch), and tests/ with 87 smoke tests across two suites:

- tests/utils.test.js (42 tests) — pure functions in utils.js:
  stripEmailQuotes, stripMobileFooter, extractRawEmail, escapeHtml,
  sanitizeEmbedText, truncateEmbedDescription, replaceVariables,
  getPriorityEmoji, safeEqual, isStaff. Covers normal input, empty input,
  null/undefined, edge cases (CRLF normalization, oversize truncation,
  triple-backtick escape, code-block injection).

- tests/configSchema.test.js (45 tests) — getValidator type inference and
  per-validator validate() behavior for boolean / integer / hex_color /
  url / email / discord_id / discord_id_list / string fallback. Covers
  ALLOWED_CONFIG_KEYS membership, the ROLE_ID_TO_PING mid-key override,
  legacy "true"/"false"/numeric coercion in the string fallback, empty
  input as ok-with-empty, garbage rejection.

vitest.config.mjs sets `environment: 'node'`, `globals: false`, and
`include: ['tests/**/*.test.js']`. Foundation for the mongoose 6→8
upgrade — these tests don't touch the DB but confirm pure-function
behavior is preserved across dependency moves.

package.json

@@ -8,7 +8,8 @@
     "mongoose": "^6.12.0"
   },
   "devDependencies": {
-    "mongodb": "^7.1.0"
+    "mongodb": "^7.1.0",
+    "vitest": "^4.1.5"
   },
   "name": "broccolini-bot",
   "version": "1.0.0",
@@ -16,6 +17,7 @@
   "main": "broccolini-discord.js",
   "scripts": {
     "start": "node broccolini-discord.js",
+    "test": "vitest run",
     "test-mongodb": "node scripts/test-mongodb.js"
   },
   "keywords": [],