Add unit test coverage for core modules

[TimElschner]

Summary

• Adds 110+ unit tests across 7 new test files covering previously untested core modules
• Exports maskSecrets (git.ts) and escapeTelegramMarkdown (notifications.ts) for direct testability
• All unit tests run without a Dockhand instance — zero external dependencies

Test Files

File	Tests	Covers
tests/utils.test.ts	37	compareVersions, shouldShowWhatsNew, computeAuditDiff, formatFieldName, ipToNumber
tests/encryption.test.ts	24	AES-256-GCM encrypt/decrypt roundtrips, isEncrypted, generateKey
tests/git-utils.test.ts	23	maskSecrets, parseEnvFileContent
tests/notifications-utils.test.ts	9	escapeTelegramMarkdown
tests/auth.test.ts	13	Rate limiting (5-attempt lockout), hashPassword/verifyPassword
tests/authorize-helpers.test.ts	4	unauthorized(), forbidden(), enterpriseRequired()
tests/api-smoke.test.ts	10	REST API endpoint smoke tests (requires running instance)

Source Changes (minimal)

• src/lib/server/git.ts: function maskSecrets → export function maskSecrets
• src/lib/server/notifications.ts: function escapeTelegramMarkdown → export function escapeTelegramMarkdown

Test plan

• bun test tests/utils.test.ts — 37 pass
• bun test tests/encryption.test.ts — 24 pass
• bun test tests/git-utils.test.ts — 23 pass
• bun test tests/notifications-utils.test.ts — 9 pass
• bun test tests/auth.test.ts — 13 pass
• bun test tests/authorize-helpers.test.ts — 4 pass
• bun test tests/api-smoke.test.ts — requires running Dockhand instance

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
5 out of 6 committers have signed the CLA.

✅ sieren
✅ FlintyLemming
✅ shamoon
✅ TimElschner
✅ vikte
❌ jotka
_{You have signed the CLA already but the status is still pending? Let us recheck it.}