improve: web package has zero test files

[justn-hyeok]

packages/web/ has no test files. Auth middleware (timingSafeEqual), rate limiting, CORS, session routes, WebSocket handler, frontend hooks — all untested. Given security-critical nature (auth, file reads), this is a significant gap.

[justn-hyeok]

Already resolved: 37 test files, 424 tests exist in packages/web/tests/ as of v2.2.2.