Add tests for the store and the API

Rack::MockRequest with a cookie jar rather than rack-test, so the suite
needs nothing beyond the Debian packages the app already uses.

Covers key validation and batch atomicity, password hashing, the schema
version guard, auth and lockout, the storage API, and that a note
containing a closing script tag can't break out of the bootstrap block.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UU1vyTHj3uE9PJYSxRxwkU

Rakefile

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rake/testtask'
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << 'test'
+  t.test_files = FileList['test/*_test.rb']
+  t.warning = false
+end
+
+desc 'Run the app locally on http://127.0.0.1:8047'
+task :server do
+  sh 'puma --bind tcp://127.0.0.1:8047 config.ru'
+end
+
+task default: :test