Backend test infrastructure + init handler tests

Context

PR #36 added the rootkey handshake ({type:"init",rootKey:"<base64>"}) and structured error-frame broadcast on the control socket. The native side (Android FGS + iOS NodeJSService) and the JS bridge both got direct test coverage, but the backend validation logic in backend/index.js did not.

Specifically untested today:

• init handler: rejects non-string rootKey, rejects wrong-length-after-decode, ignores second init after consumption.
• handleFatal / uncaughtException path: tagged-phase routing, broadcast-then-exit, the 100ms flush wait.
• SimpleRpcServer.broadcastError: per-client try/catch, frame shape.

Why deferred

The backend/ directory has no test runner today (no mocha/tap/jest, no *.test.js invocation in package.json). Adding meaningful coverage means:

1. Pick + add a test runner (likely node --test for zero-deps).
2. Refactor the inline init handler in backend/index.js into something importable (or build a small test harness that drives the full process via child_process.spawn + a fake control-socket client).

PR #36 review explicitly deferred this as out of scope for the rootkey landing.

Acceptance

• Test runner wired up (likely node --test, or align with whatever the rest of the repo standardises on).
• init handler: malformed payload → process exits non-zero with broadcast {type:"error",phase:"init",…}.
• Construction failure (e.g. malformed privateStorageDir): broadcast {type:"error",phase:"construct",…} before exit.
• Uncaught throw mid-runtime: same broadcast with phase:"runtime".

Start with backend/index.js and package.json, then review PR #36 for the deferred behavior. Choose and wire a test runner, and inspect the init, handleFatal/uncaughtException, and SimpleRpcServer.broadcastError paths. Done means tests cover malformed init, construction failure, runtime throws, error phases, client handling, and broadcast-before-exit behavior.