test: add CLI and fetch integration tests (closes #65)

[dmchaledev]

Summary

Closes #65.

cli.ts and fetch.ts had 0% test coverage despite the CLI's exit-code CI gate being the library's primary use case. This PR adds two test files that cover those modules end-to-end with no new runtime or dev dependencies.

test/cli.test.ts — 12 cases:

• Exits 0 for A+ sites; exits 1 for D-grade and F-grade sites (the CI gate)
• --json emits valid JSON with grade, score, headers, and url fields
• --version / -v prints a semver string
• --help / -h prints usage text
• Missing URL writes a usage hint to stderr and exits 1
• Network errors write the error message to stderr and exit 1
• --timeout 3000 forwards { timeoutMs: 3000 } to fetchHeaders

test/fetch.test.ts — 7 cases:

• Response headers are returned as lowercase key-value pairs
• GET is used instead of HEAD (prevents false-negative CSP omissions)
• An AbortSignal is wired into the fetch call
• The response body is cancelled after headers are collected
• A null body doesn't throw
• The request is aborted after timeoutMs elapses
• The abort timer is cleared after a successful fetch (no post-test interference)

src/cli.ts — one-line change: main() → await main(). The module's top-level call was unwaited, so a dynamic import('../src/cli.js') would resolve before main() ran, making it impossible to capture output or exit codes in tests. Top-level await in an ESM module (already used by this package: "type": "module", "module": "NodeNext") makes the import wait for main() to settle.

---

Generated by Claude Code