Add test coverage retrofit for Phase 1/2 (worker, api, frontend)

Requested after Phase 2: from here on, MCMapper development follows
TDD (test-first) — this retrofits the pieces already built before that
request landed.

worker: unit tests for the tile rasterizer (background fill, exact
upscaled-block boundaries, full-grid painting, out-of-bounds columns) and
the block-color palette (distinctness checks, including that the
"unmapped block" placeholder never accidentally collides with a real
block's color). 16 tests total alongside the existing mesher tests.

api: wired up `bun test`. Unit tests for chunkOf's coordinate math.
Integration tests (real Postgres/Redis/MinIO, see README's new "Running
tests" section) for wsGateway.message() — auth accept/reject, upsert +
dedup on columns/sections, not-authenticated/invalid-JSON handling — and
for the tile/mesh/servers HTTP routes, driven through Elysia's in-process
`.handle()` rather than a bound port (sidesteps the stale dev-server
port-collision issue hit repeatedly this session). index.ts now exports
`app` and only calls `.listen()` when run directly, specifically so tests
can drive it this way.

frontend: extracted mesh.js's binary-format parser into its own ESM
module (mesh-format.js) so it's unit-testable without a browser/Babylon;
mesh.js now imports it. Tests build a buffer independently of the parser
(mirroring worker's encoder layout) so a mismatch in either direction —
Rust producer or JS consumer drifting — would be caught.

README.md

@@ -76,6 +76,31 @@ tiles appear at `GET /api/tiles/:serverId/:dimension/:zoom/:tileX/:tileY.png` (z
 for now — see `worker/src/render/cpu.rs`) and the frontend's Leaflet viewer picks them up
 automatically from `GET /api/servers`.
 
+## Running tests
+
+`worker`'s tests (`cargo test`, in `worker/`) are pure unit tests (greedy mesher, tile
+rasterizer, block-color palette) and need nothing running. `api`'s and `frontend`'s (`bun test`,
+in each directory) are integration tests against real infra — start it first:
+
+```
+docker run -d --name mcmapper-test-pg -e POSTGRES_USER=mcmapper -e POSTGRES_PASSWORD=mcmapper -e POSTGRES_DB=mcmapper -p 15432:5432 postgres:17-alpine
+docker run -d --name mcmapper-test-redis -p 16379:6379 redis:7-alpine
+docker run -d --name mcmapper-test-minio -e MINIO_ROOT_USER=mcmapper -e MINIO_ROOT_PASSWORD=mcmapper-dev-only -p 19000:9000 minio/minio:latest server /data
+cd api && DATABASE_URL=postgres://mcmapper:mcmapper@localhost:15432/mcmapper bun run migrate
+```
+
+then, from `api/` or `frontend/`:
+
+```
+DATABASE_URL=postgres://mcmapper:mcmapper@localhost:15432/mcmapper \
+REDIS_URL=redis://localhost:16379 \
+MINIO_ENDPOINT=localhost MINIO_PORT=19000 MINIO_ACCESS_KEY=mcmapper MINIO_SECRET_KEY=mcmapper-dev-only \
+bun test
+```
+
+Each test file creates and tears down its own server row (random token per run) so runs never
+collide with each other or with real dev data — see `api/src/test-helpers.ts`.
+
 ## Attribution
 
 See `THIRD_PARTY_NOTICES.md`.