Add full test suite with unit, integration, and E2E smoke tests.

Introduce test.bat orchestrating Go/Vitest/Playwright phases, expand coverage across server, agent, and dashboard, and document in tests/README.md.

server/internal/builder/media_lock_test.go

@@ -1,15 +1,57 @@
 package builder
 
 import (
+	"encoding/base64"
+	"io"
 	"os"
 	"path/filepath"
 	"testing"
 )
 
+func decryptMediaForTest(encPath string, key []byte, outPath string) error {
+	in, err := os.Open(encPath)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+	head := make([]byte, len(mediaLockMagic))
+	if _, err := io.ReadFull(in, head); err != nil || string(head) != mediaLockMagic {
+		return err
+	}
+	out, err := os.Create(outPath)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+	buf := make([]byte, 256*1024)
+	ki := 0
+	for {
+		n, readErr := in.Read(buf)
+		if n > 0 {
+			plain := make([]byte, n)
+			for i := 0; i < n; i++ {
+				plain[i] = buf[i] ^ key[ki%len(key)]
+				ki++
+			}
+			if _, err := out.Write(plain); err != nil {
+				return err
+			}
+		}
+		if readErr == io.EOF {
+			break
+		}
+		if readErr != nil {
+			return readErr
+		}
+	}
+	return nil
+}
+
 func TestEncryptMediaRoundTrip(t *testing.T) {
 	dir := t.TempDir()
 	src := filepath.Join(dir, "clip.mkv")
 	enc := filepath.Join(dir, "clip.mkv.cmdata")
+	dec := filepath.Join(dir, "clip-out.mkv")
 	plain := []byte("fake movie bytes 12345")
 	if err := os.WriteFile(src, plain, 0644); err != nil {
 		t.Fatal(err)
@@ -25,4 +67,16 @@ func TestEncryptMediaRoundTrip(t *testing.T) {
 	if st.Size() <= int64(len(plain)) {
 		t.Fatalf("encrypted size unexpected: %d", st.Size())
 	}
+	if err := decryptMediaForTest(enc, key, dec); err != nil {
+		t.Fatal(err)
+	}
+	got, err := os.ReadFile(dec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(plain) {
+		t.Fatalf("roundtrip mismatch")
+	}
+	_ = base64.StdEncoding.EncodeToString(key) // key format used in manifest
 }
+