No test framework exists: add Vitest and cover the pure logic modules

[royalpinto007]

Problem

There is no test framework in this repository at all: no test runner in devDependencies, no test script in package.json, and no test files. #48 covers adding CI for lint, type check, and build. This issue is about the thing CI would run after that.

That matters more than usual here because the repo has grown a real set of pure logic modules that are cheap to test and currently have zero coverage:

• src/app/(site)/prospects/savedProspectsExport.ts, including escapeCsv and flattenProspect
• src/app/(site)/prospects/savedProspectsData.ts, in particular applyFilters
• src/app/(site)/prospect/[id]/prospectFormat.ts and prospectDraft.ts
• src/components/Pricing/formatPrice.ts
• src/utils/validateEmail.ts and src/utils/markdownToHtml.ts
• src/components/Header/headerUtils.ts

Several open issues on this repo (#39, #40, and the PostgREST filter escaping issue) are precisely the kind of bug a handful of unit tests would have caught and would stop from coming back.

Suggested approach

1. Add Vitest with @vitejs/plugin-react and jsdom, plus a test and test:watch script. Vitest is the low friction choice for a Next 15 project that has no runner yet.
2. Add co-located *.test.ts files for the pure modules above. Start with escapeCsv and flattenProspect, since the export path is where two open bugs already live.
3. Add one component test with Testing Library to prove the setup works for .tsx, for example PricingBox rendering the right button label for each plan and session combination (the getButtonConfig logic in usePricingBoxState.ts).
4. Wire npm test into the CI workflow from No CI: lint, type check and build never run on pull requests #48, and document it in the CONTRIBUTING file from Add CONTRIBUTING.md and GitHub issue/PR templates #47.

Done when

• npm test runs and passes locally and in CI.
• Every module in the list above has at least one meaningful test, including the boundary cases named in Saved prospect exports can silently fail: the download anchor is detached and the object URL is revoked immediately #39 and CSV and Excel export is vulnerable to spreadsheet formula injection #40.
• CONTRIBUTING tells contributors to run it.

Coordinate with whoever picks up #48 so the CI job and the test script land in a sensible order.

---

If you want to take this on, comment on the issue to claim it and it will be assigned. Please keep to a maximum of 2 open claims per person at a time so other contributors get a chance.