test: add unit tests for API route error conditions

[JosephOnuh]

Summary

Closes #523

Sets up vitest and adds 20 unit tests covering every validation failure and external dependency error path across both API routes.

Test setup

• vitest@3.2.4 + @vitest/coverage-v8
• vitest.config.ts with @ path alias and @solarproof/stellar source alias
• pnpm test script added to apps/web/package.json

Test coverage

POST /api/readings — 14 tests

• Invalid payloads: missing fields, bad UUID, non-positive kwh, non-integer timestamp, wrong signature length, non-JSON body → 400
• Meter not found / inactive → 404
• Invalid Ed25519 signature → 401
• Ed25519 verify throws → 401
• DB insert failure → 500
• On-chain anchor throws → 500 (includes reading_id in response)
• Mint throws → 500 (includes anchor_tx_hash in response)
• Missing cooperative admin address → 500

GET /api/verify — 6 tests

• Missing id param → 400
• Empty id param → 400
• Certificate not found → 404
• Full chain of custody returned → 200
• Null meter_proof when reading is missing → 200
• Stellar explorer URLs present in response

Acceptance criteria

• Tests for invalid payloads, missing fields, and unauthorized access
• External failure cases simulated with mocks (Supabase, anchorReading, mintCertificates, Ed25519 verify)
• Regression coverage prevents silent failure paths