feat(testing): add vitest suite + guerrilla mail email pool

- Vitest unit tests for POST /api/erase: validation, form-only
  providers, all email providers, CRLF sanitization
- Snapshot on PROVIDER_DATA to catch provider config drift
- Mock via require cache to avoid nodemailer/sendmail dependency
- sendErasureMail call assertions (args + call count)
- fetch-test-emails.mjs script to refresh disposable email pool
- mailer: add Reply-To header pointing to requester email
- mailer: fallback to direct transport when sendmail unavailable

api/package.json

@@ -5,15 +5,23 @@
   "main": "app.js",
   "scripts": {
     "start": "node app.js",
-    "dev": "node --watch app.js"
+    "dev": "node --watch app.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "emails:fetch": "node scripts/fetch-test-emails.mjs"
+  },
+  "engines": {
+    "node": ">=18"
   },
-  "engines": { "node": ">=18" },
   "dependencies": {
+    "dotenv": "^16.4.5",
     "express": "^4.19.2",
-    "helmet": "^7.1.0",
     "express-rate-limit": "^7.3.1",
-    "nodemailer": "^6.9.13",
     "googleapis": "^144.0.0",
-    "dotenv": "^16.4.5"
+    "helmet": "^7.1.0",
+    "nodemailer": "^6.9.13"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.4"
   }
 }