test: add real-code unit tests for utils + auth primitives, wire up coverage

Commit notes

The existing suite largely reimplemented logic inside the test files (fake Elysia apps, in-memory auth, copied DSP algorithms) so it passed without exercising production code. This adds 7 test files that import and test the ACTUAL modules:

- utils/sanitize (SQL LIKE escaping, XSS reflection, slug/UUID/pagination) - utils/slug (slug generation + async uniqueness loop) - utils/hash (content hashing, buffer/stream parity, known SHA-256 vector) - utils/format (byte formatting boundaries) - utils/audio-validation (magic-byte gate: accept/reject + real file reads) - auth/password (bcrypt salting + verification) - auth/jwt (HS256 sign/verify, tamper detection, expiry)

Also wires up coverage: adds test:coverage / test:watch scripts and bunfig coverage settings. New modules now report ~100% line coverage.

66 new tests, full suite green (160 pass / 0 fail).