ci: run vitest and cargo test on every PR

The preview workflow is the PR check, but until now it only built: neither
test suite ran anywhere but a developer's machine. That matters most for the
app-command ACL census from #60. An ungranted command compiles fine and only
fails at runtime, so `cargo test` and vitest's capabilities.test.ts are the
guards that catch it before merge.

The new `test` job runs `npm ci`, `npm run build` (tsc, plus the dist/ that
generate_context! needs), `npx vitest run` and `cargo test --locked`. It has
no `needs`, so it runs alongside the three platform builds instead of
delaying them. Verified in a fresh clone: 975 vitest and 675+3 cargo tests
pass, and the tree stays clean.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -843,3 +843,10 @@ Frontend tests use Vitest with jsdom environment and React Testing Library. Setu
 cd app
 npx vitest run src/path/to/test.test.ts
 ```
+
+CI runs both suites on every PR: the `test` job in `.gitea/workflows/build-app-preview.yml` does
+`npm run build`, `npx vitest run` and `cargo test --locked`, in parallel with the platform builds.
+It is the only place `cargo test` runs on merge, which matters most for the app-command ACL
+census — an ungranted command compiles and only fails at runtime. `build-app.yml` (releases
+from `main`) deliberately does not repeat it. The runner is root, so the few Rust tests that
+exercise file permissions skip themselves there.