test(client): unit-test the pure-logic modules + wire coverage into CI/Sonar

Stand up a client test suite on Node's built-in runner (no vitest/jsdom — the
targeted modules are plain ESM with no browser/DOM deps) and cover the
meaningful client logic, not presentational components:

- api/client.js: the fetch wrapper — always sends the session cookie, maps a
  non-2xx response to a thrown ApiError (body.message → statusText fallback),
  resolves an empty body to null, sets Content-Type for JSON but NOT for raw
  FormData uploads, and builds/encodes query strings + path params.
- lib/shardEvents.js: describe() across event kinds (payload vs live frame,
  actor name→acct→"Someone" fallback, sale pluralization, champ.update
  branches) and the categoryOf table-consistency check.
- data/regionBuckets.js: the presence roll-up, incl. the first-match-wins
  ordering and the "buckets always reconcile to the total" invariant.
- lib/heroLayout.js: parseLayout's version/shape guard and heroBackground's
  default-vs-custom branch.
- lib/format.js: the date/label formatters + relative-time buckets.

Wiring so these actually count:
- client/package.json gains a `test` script (node --test);
- pr-checks.yml runs the client tests as a PR gate;
- sonarqube.yml generates a client LCOV report and sonar-project.properties
  feeds it alongside the server report (SF paths resolve to client/src/...).

43 client tests; coverage on the tested modules: format/regionBuckets/
heroLayout 100%, api client 86%, shardEvents 80%.

Co-Authored-By: Claude <noreply@anthropic.com>

sonar-project.properties

@@ -10,18 +10,19 @@ sonar.projectName=runic gateway website
 sonar.sources=server/src,client/src,bot/src
 
 # Test code is analysed separately from sources so coverage/metrics attribute
-# correctly. Only the server has a test suite today.
-sonar.tests=server/test
-sonar.test.inclusions=server/test/**/*.test.js
+# correctly. The server suite and the client's pure-logic unit tests both run on
+# Node's built-in test runner (no browser/DOM), so they live side by side here.
+sonar.tests=server/test,client/test
+sonar.test.inclusions=server/test/**/*.test.js,client/test/**/*.test.js
 
-# Coverage. The sonarqube.yml workflow runs the server suite with Node's built-in
-# test-coverage and writes an LCOV report here BEFORE the scan runs; without it
-# the dashboard shows 0% (the scanner never executes tests itself). The SF: paths
-# in the report are repo-root-relative (server/src/...) so the scanner resolves
-# them against the project base dir.
-sonar.javascript.lcov.reportPaths=server/coverage/lcov.info
+# Coverage. The sonarqube.yml workflow runs both suites with Node's built-in
+# test-coverage and writes an LCOV report for each BEFORE the scan runs; without
+# them the dashboard shows 0% (the scanner never executes tests itself). The SF:
+# paths in each report are repo-root-relative (server/src/... , client/src/...) so
+# the scanner resolves them against the project base dir.
+sonar.javascript.lcov.reportPaths=server/coverage/lcov.info,client/coverage/lcov.info
 
 # Never analyse dependencies, build output, generated specs, or runtime dirs.
-sonar.exclusions=**/node_modules/**,client/dist/**,client/public/**,server/swagger/**,server/logs/**,server/uploads/**,server/coverage/**,**/*.min.js
+sonar.exclusions=**/node_modules/**,client/dist/**,client/public/**,server/swagger/**,server/logs/**,server/uploads/**,server/coverage/**,client/coverage/**,**/*.min.js
 
 sonar.sourceEncoding=UTF-8