Add unit test coverage and PR-level CI

[Fgerthoffert]

Summary

Adds a unit test suite (24 new spec files, 113 tests, all passing) and makes lint + tests + build run on every pull request.

Tests added

• Webhook controllers (github, perfs, testing): HMAC signature verification (valid/invalid/missing), ping handling, event-to-entity mapping, and include/exclude routing to the bull queues — using real computed signatures, not mocked crypto.
• Services: ConfigService (default config bootstrap + exit, loading an existing config, env handling — against a temp dir), EsClientService (cloud / SSL / plain host connection branches), GhClientService (rate-limit tracking, graphql error logging, fetchNodesById retry/give-up logic).
• Bull processors: the three thin github processors, plus the full transformation logic of testingStorePayload (state/run/cases enrichment, success rates, cases stripping) and perfsStorePayload (transaction dedup, resources, tags handling).
• fetchNode: the dispatcher plus all nine payload processors (delete branches, fetch-and-push happy paths, per-source index aliasing, empty-fetch guards).

Coverage of the meaningfully testable code is near-complete; overall statements sit around 90% (the remainder is mostly the apollo client constructor wiring and module definitions).

Making CI installable again: vendored @bit tarballs

Fresh yarn install was impossible — the bit.dev npm registry is gone (returns HTTP 423 "no longer supported"; the suggested replacement host errors as well). Any PR-level CI would have failed at install. This PR vendors the 15 @bit/zencrepes.zindexer.* tarballs (~250 KB, packed from the known-good installed versions) into .yarn-offline-mirror/, wired via .yarnrc, with the matching checksums updated in yarn.lock. Verified with a clean-cache yarn install --frozen-lockfile in an empty directory. A .gitignore inside the mirror keeps yarn from committing tarballs of regular npm packages it copies there.

CI changes (lint-test.yml)

• Triggers on pull_request (and pushes to master) instead of pushes to all branches.
• Pinned to node:22-alpine matching the Dockerfile (@nestjs/bull 0.1.x breaks on Node ≥ 23 — util.isString removal).
• yarn install --frozen-lockfile, tests run with coverage, removed the stale global typescript@3.8.3 install from the build job.
• test/jest.setup.js shims util.isString so the suite also runs on newer local Node versions.

Pre-existing bugs noticed while testing (left as-is, candidates for the modernization pass)

• src/github/fetchNode/processIssue.ts:84 — the delete error handler logs payload.label.node_id for an issue payload (copy-paste), which itself throws.
• src/ghClient.service.ts:126 — if the graphql query throws, data.data is undefined and graphqlQuery crashes with a TypeError instead of returning gracefully.
• src/github/fetchNode/processRepository.ts — reads dataIndices.GithubRepos (capital G, always undefined) and runs the alias step outside the fetched-data guard.

🤖 Generated with Claude Code