tests: one fixture for the note grammar, run by the core, the server and the web

The checklist grammar and the #tag rule are implemented three times (derive.rs,
checklist.py/tags.py, markdown.ts), and the tag colour twice (colors.ts,
DerivedTint.kt). Only Rust and Kotlin had tests. core/testdata/grammar.json now
holds one set of cases (task lines, rendered items, tags, standalone-tag lifts
and the tint hashes), and every suite reads it.

- web: vitest, a dev dependency approved for #5166, with `npm test`.
  grammar.test.ts runs the fixture, and titles.test.ts pins #5165's palette fix.
- ci.yml runs the web tests in the job the image build needs. desktop.yml's
  verify job runs them too, because the installers embed this frontend and
  can't see ci.yml's verdict (rule 177).
- core: derive.rs reads the fixture. server: tests/test_grammar_fixture.py.
- Android keeps its hand-written tint values; its doc now points at the fixture.

The server is expected red here, on purpose. tags.py only takes a tag after
whitespace and lets it start with a digit or `_`, while the core (the
definition) takes any non-tag boundary and needs a letter. So `(#todo)` is a
label on the phone and plain text on the server. The fix follows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -143,8 +143,12 @@ jobs:
             echo "build=true" >> $GITHUB_OUTPUT
           fi
 
+  # The web's whole verification: the type check, then its unit tests. Both in the
+  # job `build` already needs, so a red web test blocks the image like any other
+  # lane (rule 177). The unit tests arrived with #5166; before them the web copy of
+  # the note grammar, mirrored in Rust and Python, was guarded by nothing.
   typecheck:
-    name: TypeScript typecheck
+    name: Web typecheck and unit tests
     if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
     runs-on: python-ci
     container:
@@ -160,6 +164,10 @@ jobs:
         run: npx vue-tsc --noEmit
         working-directory: frontend
 
+      - name: Unit tests
+        run: npm test
+        working-directory: frontend
+
   lint:
     name: Python lint
     if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'

.forgejo/workflows/desktop.yml

@@ -89,7 +89,7 @@ jobs:
   # bundling. No `always()` or `continue-on-error` anywhere on this path: a skipped
   # or failed verify must leave both publishers skipped.
   verify:
-    name: Clippy, tests and rustfmt
+    name: Web tests, clippy, Rust tests and rustfmt
     needs: [decide]
     if: needs.decide.outputs.build == 'true'
     runs-on: python-ci
@@ -105,6 +105,13 @@ jobs:
         run: npm ci && npm run build
         working-directory: frontend
 
+      # The web's unit tests, HERE as well as in ci.yml. The installers embed this
+      # frontend, and ci.yml's verdict is invisible to this workflow — run there only,
+      # a red web test would still let both installers publish (rule 177).
+      - name: Web unit tests
+        run: npm test
+        working-directory: frontend
+
       # --locked on the FIRST cargo invocation is the lockfile gate: it fails the
       # run if Cargo.toml and the committed Cargo.lock disagree, instead of silently
       # re-resolving (issue 2102). Both publishing jobs need this job, so neither