feat: add Vitest testing framework, fix proxy auth stripping and 401 handling

- Set up Vitest with jsdom for client tests, node for server tests
- Add tests for auth service, proxy handler, API client, and profiles store
- Strip Authorization header in proxy to prevent web-ui token leaking to gateway
- Distinguish local BFF vs proxied gateway 401s to avoid false logouts
- Remove unused hero.png asset

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

package.json

@@ -35,7 +35,10 @@
     "dev:client": "vite --host",
     "dev:server": "nodemon --signal SIGTERM --watch packages/server/src -e ts,tsx --exec node -r ts-node/register packages/server/src/index.ts",
     "build": "vue-tsc -b && vite build && tsc -p packages/server/tsconfig.json",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
   },
   "files": [
     "bin/",
@@ -65,6 +68,7 @@
     "ws": "^8.20.0"
   },
   "devDependencies": {
+    "@pinia/testing": "^1.0.3",
     "@types/js-yaml": "^4.0.9",
     "@types/koa": "^2.15.0",
     "@types/koa__cors": "^5.0.0",
@@ -76,13 +80,16 @@
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-vue": "^6.0.5",
+    "@vue/test-utils": "^2.4.6",
     "@vue/tsconfig": "^0.9.1",
     "concurrently": "^9.2.1",
+    "jsdom": "^27.0.1",
     "nodemon": "^3.1.14",
     "sass": "^1.99.0",
     "ts-node": "^10.9.2",
     "typescript": "~6.0.2",
     "vite": "^8.0.4",
+    "vitest": "^3.2.4",
     "vue-tsc": "^3.2.6"
   }
-}
+}