feat(03-01): stand up web/ npm workspace with Wave-0 hand-rolled test runner (D-01, D-02, D-11, D-14)

- web/ workspace: TS + Vite shell (maplibre-gl 6.15.0, vite 8.3.5, TS 5.9.3; no UI framework, no Telegram SDK script tag)
- tsconfig mirrors bot/ strictness byte-for-byte except the three authorized keys (DOM lib, vite/client types, resolveJsonModule)
- test/runner.mjs + harness.mjs copied verbatim from bot/test/ (body-identical past header)
- root package.json: web workspace + web:* delegate scripts
- web/src/main.ts entry module created (tsc include:['src'] needs ≥1 input; 03-02/03-03 mount here)

web/test/harness.mjs

@@ -0,0 +1,10 @@
+/*
+ * harness.mjs — zero-dependency test registry (D-12).
+ * Suites import { test } and register async cases; runner.mjs drains the registry.
+ * Same hand-rolled shape as theme/scripts/audit.test.mjs (Phase 1 precedent).
+ */
+const tests = [];
+export function test(name, fn) {
+  tests.push({ name, fn });
+}
+export const registry = tests;

web/test/runner.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+/*
+ * runner.mjs — hand-rolled zero-dependency test runner (D-02, D-11).
+ *
+ * Auto-discovers *.test.mjs in this directory (sorted), dynamic-imports
+ * them, and drains the harness registry. A suite that fails to LOAD is
+ * recorded as one failing case — the run never crashes mid-way.
+ * Same hand-rolled shape as theme/scripts/audit.test.mjs (Phase 1)
+ * and bot/test/ (Phase 2) — copied verbatim, workspace-agnostic.
+ */
+import { readdirSync } from "node:fs";
+import { registry } from "./harness.mjs";
+
+const dir = import.meta.dirname;
+const suites = readdirSync(dir)
+  .filter((f) => f.endsWith(".test.mjs"))
+  .sort();
+
+for (const file of suites) {
+  try {
+    await import(`./${file}`);
+  } catch (loadErr) {
+    registry.push({
+      name: `suite load failed: ${file}`,
+      fn: () => {
+        throw loadErr;
+      },
+    });
+  }
+}
+
+let passedCount = 0;
+let failedCount = 0;
+for (const { name, fn } of registry) {
+  try {
+    await fn();
+    passedCount++;
+    console.log(`PASS ${name}`);
+  } catch (err) {
+    failedCount++;
+    console.log(`FAIL ${name}`);
+    console.error(`  ${err && err.stack ? err.stack : String(err)}`);
+  }
+}
+
+console.log(`[runner] ${passedCount} passed, ${failedCount} failed`);
+process.exitCode = failedCount > 0 ? 1 : 0;