SPA test infrastructure — Vitest + Testing Library, start with claims.ts role decode #105

The SPA (web/) has zero automated tests — only tsc -b typecheck and per-PR manual Playwright drills. Backend carries 296 integration tests; the front end has no equivalent safety net. Client-side logic that is pure, security-adjacent, or easy to silently break has no regression guard.

Scope

Test runner + libraries (devDependencies):

• Vitest (Vite-native, shares the existing vite.config), @testing-library/react, @testing-library/user-event, @testing-library/jest-dom, jsdom (or happy-dom) environment.
• test + test:watch scripts in web/package.json; wire test into CI alongside typecheck and build.
• Vitest config (env=jsdom, globals, setup file importing @testing-library/jest-dom).

First unit coverage — pick the pure, high-value targets:

• web/src/auth/claims.ts — currentUserRole() JWT decode: base64url payload parse, role as string vs string[], highest-role precedence (Admin>Manager>Sales>ReadOnly), no-claim → Worker, unknown-role-only → Denied (mirrors the F27 backend rule — a decode regression silently mis-gates the whole UI), malformed/absent token → Worker. currentUserIsAdmin() Owner+Manager true, others false.
• Money/currency formatting helper(s) — minor-units → display using the row's snapshotted currencyMinorUnit (no re-denomination), zero/negative, non-2-dp currencies.
• Any allocation/quantity-base display math that mirrors backend snapshot rules.

One component/interaction smoke test to prove the harness renders + queries (e.g. a role-gated nav element shows/hides on decoded role).

Non-goals

• No full E2E runner (Playwright stays the manual per-PR drill for now; a CI E2E harness is a separate later slice if wanted).
• No chase for a coverage %; start with the pure logic that hurts most when it breaks.

Tests (of the tests)

• Suite runs green locally (npm run test) and in CI.
• claims.ts cases above all covered, including the Denied vs Worker distinction.

Sync

• Contributor note in web/ README (or root dev docs) on how to run/write SPA tests.

Part of Phase 1.1 epic #14.