test: characterize content API seam

[mkczarkowski]

What changed

Adds tests/api-content.test.ts, a sibling characterization suite for
src/lib/api-content.ts, the highest churn x coupling src/lib module without
a sibling test.

Deep Focus ranking:

Module	12-month churn	Static coupling (dependencies + dependents)	Score
api-content.ts	7	6	42
tool-prompt.ts	5	7	35
format.ts	1	3	3
fs-utils.ts	1	1	1

The tests pin current request encoding, bearer token and abort-signal forwarding,
partial signature-header rejection, API-error pass-through before signature
checks, and the current artifact query quirk where tool is always serialized
while an empty optional lang is omitted.

No production behavior changes.

Reward-hacking guard

The following temporary mutation flipped the API-result branch:

diff --git a/src/lib/api-content.ts b/src/lib/api-content.ts
index fb02d4d..d6b7f35 100644
--- a/src/lib/api-content.ts
+++ b/src/lib/api-content.ts
@@ -154,7 +154,7 @@ export async function fetchLesson(
   const path = `/api/lessons/${encodeURIComponent(course)}/${encodeURIComponent(lessonId)}${qs ? `?${qs}` : ""}`;
   const result = await apiGet<LessonBundle>(path, { token, signal: options.signal });
 
-  if (!result.ok) return result;
+  if (result.ok) return result;
 
   const signature = result.responseHeaders.get("X-Bundle-Signature");

The new suite failed under that mutation:

bun test v1.3.8 (b64edcb4)

tests/api-content.test.ts:
(pass) content API request + signature contracts > encodes catalog paths and forwards the bearer token and caller signal
(fail) content API request + signature contracts > rejects a successful lesson response when only some signing headers are present
error: expect(received).toEqual(expected)

- Expected: signature_error
+ Received: successful lesson payload

(fail) content API request + signature contracts > passes API errors through before checking their incomplete signing headers
TypeError: undefined is not an object (evaluating 'result.responseHeaders.get')
(pass) content API request + signature contracts > always serializes artifact tool, while omitting an empty optional language

 2 pass
 2 fail
 9 expect() calls
Ran 4 tests across 1 file.

The production module was then restored exactly (git diff --exit-code -- src/lib/api-content.ts exited 0), and the targeted suite passed:

 4 pass
 0 fail
 10 expect() calls
Ran 4 tests across 1 file.

Validation

• bun run typecheck: passed
• bun run lint: 0 errors, 2 pinned warnings
• bun test: pass count rose from 454 to 458 with exactly the same 8 pinned
  failures