ci: generate and upload the unit coverage report

The unit job ran test:unit without coverage, so the agreed "collect a
coverage report in CI" was never actually produced. Run npm run coverage
(unit suite + v8 report, still ungated) and upload web/coverage as an artifact.

https://claude.ai/code/session_01EeGweBeouxSsT6nSaXy8Pk

Author: claude

.github/workflows/ci.yml

@@ -31,7 +31,13 @@ jobs:
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - run: cd web && npm ci
-      - run: cd web && npm run test:unit
+      - run: cd web && npm run coverage   # runs the unit suite + prints a coverage report (not gated)
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: web-coverage
+          path: web/coverage/
+          retention-days: 7
 
   e2e:
     name: Playwright E2E