chore(ci): add v8 test coverage tracking (non-blocking baseline)

CI previously ran `pnpm run test || true` — test failures were silently
swallowed with no artifact, so we had no visibility into what was actually
passing across 1,296 test files.

- New `test:coverage` turbo pipeline task + root script; packages that opt
  in by declaring their own `test:coverage` get picked up automatically.
- Wired up three high-value Vitest targets: apps/mana/apps/web (main
  frontend, ~590 tests), shared-ui (Svelte component library), and
  shared-storage (S3 client). Each emits lcov.info + coverage-summary.json
  + browsable HTML.
- apps/mana/apps/web `"test"` was running in watch mode (just `vitest`),
  which hangs under turbo orchestration — changed to `vitest run` and
  added `test:watch` for the interactive case.
- CI uploads coverage artifacts (14-day retention) regardless of whether
  tests passed. `continue-on-error: true` replaces `|| true` so a failed
  suite shows up as a warning annotation on the PR rather than being
  invisible. Flip to a hard gate once main is green for a full week.
- Testing guideline documents the pattern + the template vitest config
  + the planned 80% threshold.
- ESLint flat-config `vitest.config.ts` ignore only matched at the root;
  widened to `**/vitest.config.{ts,js,mjs}` so nested configs don't trip
  the project-service parser.

Coverage baseline produced locally:
  shared-storage:  91.37% lines (6 files, 123 tests)
  shared-ui:        2.87% lines (mostly Svelte components, untested)
  apps/mana/web:    9/59 test files fail — pre-existing, not regression

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -449,8 +449,32 @@ jobs:
       - name: Lint
         run: pnpm run lint
 
-      - name: Test
-        run: pnpm run test || true
+      # Coverage is produced but not yet gating — we're establishing a baseline
+      # before flipping to hard-fail. `continue-on-error: true` surfaces a
+      # proper failure signal in the PR (unlike `|| true`, which silently
+      # swallowed everything) but still lets the overall job pass.
+      # Flip to blocking by removing `continue-on-error` once the suite is
+      # green on main for a full week. Tracked in docs/plans/concern-4-coverage.md.
+      - name: Test (with coverage)
+        id: tests
+        continue-on-error: true
+        run: pnpm run test:coverage
+
+      - name: Annotate test failure (non-blocking)
+        if: steps.tests.outcome == 'failure'
+        run: |
+          echo "::warning title=Test suite failed::pnpm run test:coverage returned a non-zero exit code. Coverage artifacts were still uploaded. See the 'Test (with coverage)' step above for details."
+
+      - name: Upload coverage reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-${{ github.run_id }}
+          path: |
+            **/coverage/lcov.info
+            **/coverage/coverage-summary.json
+          if-no-files-found: warn
+          retention-days: 14
 
       - name: Security Audit
         run: |