fix: test-infra and logger/config safety (#87, #88, #89, #90)

[NovaLux12]

Summary

Four small safety fixes to the test infrastructure and the logger/config layer, found by auditing the bridge against Medtronic's live API behaviour.

• CI never typechecks test/ — tsconfig excludes it, so a TS2322 error in a test file ships green #87 — CI could not see a type error in any test file. npx tsc --noEmit reads the base tsconfig.json, which excludes test/. A TS2322 in a test compiled clean and CI stayed green. Added tsconfig.test.json, a typecheck script that runs both configs, and pointed CI and the contributor docs at it.
• logger.ts redaction misses Authorization headers and nested secrets — and logger has zero test coverage #88 — log redaction missed Authorization and nested objects. The regex matched only secret|password|token|api_secret, and redactFields was a flat loop, so {headers:{Authorization}} logged in clear. Widened the pattern, made the walk recursive, and gave the module its first direct tests.
• src/config.ts has zero test coverage — unverified safety defaults and an undocumented CARELINK_QUIET truthiness trap #89 — src/config.ts had zero coverage. Added tests for required-var errors, safety-relevant defaults, LOG_FORMAT fallback and the CUSTOMCONNSTR_ fallback, and documented the CARELINK_QUIET coercion trap: only the literal false enables verbose mode, so 0, no and yes all mean quiet and an empty value counts as unset.
• upload() logs the full entries payload at verbose level — every glucose reading in journald, undocumented #90 — verbose mode logs the full upload payload (every glucose value). That's a deliberate debug facility and it stays, but it is now documented in the settings table and on upload() itself rather than left to be discovered.

Also corrected four docs that overstated what the code does — the "secrets are never emitted" line in USER-GUIDE, "no PII" in the ARCHITECTURE module map, and the npx tsc --noEmit verification step in ARCHITECTURE and CONTRIBUTING.

Verification

npm test              → 288 passing / 24 files (baseline 246)
npm run typecheck     → clean (src, and src+test)

The new CI step is proven, not assumed: injecting const x: number = "nope" into a test file makes it fail with TS2322 while the old command still exits 0. Each redaction guard has a matching test, and reverting any one of them fails the suite. The redaction walk was audited against class instances, cross-realm objects, inherited and own toJSON, throwing getters and ownKeys traps, circular and shared references, __proto__ keys, typed arrays with attached fields, BigInt, 50 000-deep nesting and Proxy traps — nothing leaks and warn() never throws into its caller, which matters because it is called from error handlers.

Notes

Redaction is key-name matching, not content inspection, and the legacy log() helper takes positional arguments rather than a fields object so it does not redact at all. Both limits are now stated in USER-GUIDE instead of being implied away — a logger that claims more than it does is worse than one that doesn't.

Closes #87, #88, #89, #90.