fix: prevent calculate() crash when optional inputs are omitted

[dmchaledev]

Problem

The public calculate() function crashes for inputs that are valid according to its own type contract. index.d.ts documents scan_window? and compliance_needs? as optional, but the implementation reads data.compliance_needs.length and data.scan_window directly.

A programmatic caller passing a type-valid input without these fields hits a runtime error:

import { calculate } from '@hailbytes/vulnerability-calculator';

calculate({
  target_hosts: 500,
  scan_intensity: 'medium',
  scan_frequency: 'weekly',
  scanning_tools: ['openvas'],
});
// ❌ TypeError: Cannot read properties of undefined (reading 'length')

This is invisible to the bundled web component (its _collectInputs() always supplies every field), so it only bites consumers using the documented calculate() API — exactly the audience index.d.ts is written for.

Fix

Normalize optional inputs once at the entry of calculateResources():

• scan_window → defaults to 8 hours (same default the web component uses)
• compliance_needs → defaults to []
• scanning_tools → defaults to [] (treated as no tools → traditional sizing)
• calling with no arguments no longer throws

No behavior change for inputs that already supply these fields.

Tests

Added 5 regression tests under a new Optional input normalization suite. Full suite: 70 passing (was 65).

# tests 70
# pass 70
# fail 0

🤖 Generated with Claude Code

https://claude.ai/code/session_01L6U3fbFyrm4SQ2zmCbSe3w

---

Generated by Claude Code