test(fetch): add full test coverage for fetchHeaders

[dmchaledev]

Problem

src/fetch.ts — the module responsible for every live URL scan — had 0% test coverage. This means the primary user-facing path (CLI and analyze(url)) was entirely untested despite the rest of the library having ~92% coverage.

Solution

Adds test/fetch.test.ts with 12 focused unit tests covering:

Behaviour	Tests
Header normalisation (mixed-case → lowercase)	✓
Correct fetch options (GET, redirect: 'follow', AbortSignal)	✓
Response body cleanup (body.cancel() called)	✓
Null body handled without throwing	✓
Empty header set returns {}	✓
Network errors propagate	✓
Default 10 s timeout fires and aborts	✓
Custom timeoutMs respected	✓
No abort before timeout elapses	✓
Timer cleared after successful fetch	✓
Timer cleared even when fetch throws	✓

All tests use vi.stubGlobal('fetch', vi.fn()) so no real network calls are made. Timeout behaviour is verified with vi.useFakeTimers() and real AbortSignal objects (no mocking of AbortController).

Test results

Test Files  2 passed (2)
     Tests  97 passed (97)
  Duration  308ms

No new dependencies. No production code changes.

---

Generated by Claude Code