feat(testing): add vitest suite + guerrilla mail email pool

- Vitest unit tests for POST /api/erase: validation, form-only
  providers, all email providers, CRLF sanitization
- Snapshot on PROVIDER_DATA to catch provider config drift
- Mock via require cache to avoid nodemailer/sendmail dependency
- sendErasureMail call assertions (args + call count)
- fetch-test-emails.mjs script to refresh disposable email pool
- mailer: add Reply-To header pointing to requester email
- mailer: fallback to direct transport when sendmail unavailable

api/scripts/fetch-test-emails.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+/**
+ * Fetches a pool of disposable email addresses from Guerrilla Mail API
+ * and writes them to scripts/test-emails.txt (one per line).
+ *
+ * Usage:  node scripts/fetch-test-emails.mjs [count]
+ * Default count: 10
+ */
+
+import { writeFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const COUNT  = parseInt(process.argv[2] ?? '10', 10);
+const OUT    = join(dirname(fileURLToPath(import.meta.url)), 'test-emails.txt');
+const API    = 'http://api.guerrillamail.com/ajax.php';
+
+async function fetchEmail() {
+  const url = `${API}?f=get_email_address&ip=127.0.0.1&agent=resetea-test-script`;
+  const res = await fetch(url);
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const data = await res.json();
+  if (!data.email_addr) throw new Error(`Unexpected response: ${JSON.stringify(data)}`);
+  return data.email_addr;
+}
+
+async function main() {
+  const emails = new Set();
+  let attempts = 0;
+  const maxAttempts = COUNT * 3;
+
+  process.stdout.write(`Fetching ${COUNT} addresses`);
+
+  while (emails.size < COUNT && attempts < maxAttempts) {
+    attempts++;
+    try {
+      const addr = await fetchEmail();
+      if (!emails.has(addr)) {
+        emails.add(addr);
+        process.stdout.write('.');
+      }
+      // Small delay to avoid hammering the API
+      await new Promise(r => setTimeout(r, 300));
+    } catch (e) {
+      process.stderr.write(`\n[warn] ${e.message}`);
+    }
+  }
+
+  process.stdout.write('\n');
+
+  const lines = [...emails].join('\n') + '\n';
+  writeFileSync(OUT, lines, 'utf8');
+  console.log(`Saved ${emails.size} addresses → ${OUT}`);
+}
+
+main().catch(e => { console.error(e.message); process.exit(1); });

api/scripts/test-emails.txt

@@ -0,0 +1,10 @@
+ldvrpmba@guerrillamailblock.com
+cdxoatax@guerrillamailblock.com
+ourtmekp@guerrillamailblock.com
+tjjrgggw@guerrillamailblock.com
+uahmunlk@guerrillamailblock.com
+qgwuzgmz@guerrillamailblock.com
+haicjqga@guerrillamailblock.com
+lqynosqe@guerrillamailblock.com
+iqhahoij@guerrillamailblock.com
+mgxbbfig@guerrillamailblock.com