No automated tests or CI

Repo has zero test files and no test script in either \`package.json\` (root) or \`cli/package.json\`. No \`.github/workflows\` — nothing runs on push/PR (already flagged in branch protection: no required status checks because none exist).

For a security-sensitive Worker (auth, PIN hashing, rate limiting, size limits) this is risky — the last hardening PR (#3) was reviewed by hand because there's no automated way to catch a regression like the CSP breaking the shipped template.

**Ask:**
- Add a test runner (Vitest fits Cloudflare Workers well, has official \`@cloudflare/vitest-pool-workers\` support) and cover: bearer auth, PIN hash verify, rate limiting math, draft ID validation regex, upload size rejection.
- Add a \`.github/workflows/ci.yml\` that runs on PR: \`npm install\`, tests, and at minimum \`node --check src/index.js cli/index.js\`.
- Once CI exists, wire it into branch protection as a required status check.

Start with the root package.json, cli/package.json, src/index.js, and cli/index.js to understand the existing scripts and entry points. Add the requested Vitest coverage for authentication, PIN verification, rate limiting, draft ID validation, and upload limits, then add .github/workflows/ci.yml to run installation, tests, and node --check. Done means the tests and checks pass in CI and the workflow is available as a required branch-protection status check.

Written by the indexing model from the issue text.