test(frontend): guard unit tests against real network calls

[haksungjang]

Summary

Issue #267 reported the frontend unit suite flaking under CI load with a
different test failing each time, and neither failure reproduced locally.
tests/setup.ts never blocked fetch or XMLHttpRequest, so a request that
slipped past a mock could reach the real network (or hang on a host that
doesn't exist in CI) instead of failing the test that made the call — the
resulting error then surfaced later, in whatever test happened to be running
at the time.

This adds a network guard to tests/setup.ts: fetch and XMLHttpRequest
are both replaced with a stub that throws immediately, naming the current
test (via expect.getState().currentTestName) and the request URL. A test
that intentionally needs the real implementation opts in with
allowNetworkInThisTest(), which the guard re-arms on every afterEach so
the opt-out can't leak into the next test.

Ran the full 235-file / 2624-test suite three times with the guard active;
all green every time. That means the guard did its job at making leaks
attributable, but found none currently in the suite — every test file is
already mocking its network calls correctly. That explains and closes the
fetch/AggregateError symptom from the original report (it's now a
structurally impossible failure mode). The data-testid="policy-exception-row"
symptom from the same report is a different root cause (looks like Radix
portal/focus-trap timing or worker-level resource contention, not a network
leak) and is left out of scope for this PR; noted on the issue.

Verification

• node node_modules/vitest/vitest.mjs run (Node 20, full suite): 235/235
  files, 2624/2624 tests green, run three times back to back.
• Verified the guard's error message by temporarily calling fetch(...) and
  opening new XMLHttpRequest().open(...) inside a scratch test: the thrown
  error contained both the offending URL and the full current test name, e.g.
  Unmocked fetch call to "http://example.com/probe-2" during test "network guard temp probe > captures the test name and url in the thrown error".
  The scratch test file was removed before this commit.
• tsc -b --noEmit: clean.
• eslint tests/setup.ts: clean.
• node scripts/i18n-check.cjs: OK (pre-existing dynamic-key warnings only,
  unrelated to this change).
• node tools/em-dash/lint.mjs: OK.

Closes #267