test(lib): add unit tests for src/lib/anchors.ts (closes #384) - #536

…stems#384)

anchors.ts (the curated SEP-24 anchor directory backing the /anchors page
and /api/anchors) had zero test coverage. Added src/lib/__tests__/anchors.test.ts
(13 tests) and src/app/api/anchors/__tests__/route.test.ts (5 tests, this
route also had 0 tests before).

lib tests cover:
- listAnchors() with no filters returns every anchor sorted ascending by
  feePercent, and corridor: "All" behaves identically to no filter.
- The corridor filter (case-insensitively matched against Anchor.country -
  see the edge-case test below) and the exact assetCode filter, individually
  and combined (AND, not OR).
- Empty-array results (not thrown errors) for a corridor/country or
  assetCode with zero matches.
- estimateFee(): the amount * feePercent / 100 formula, its rounding to the
  nearest cent (asserted against a value that has floating-point noise
  unrounded), a zero-amount edge case, and linear scaling.
- A regression guard that listAnchors() never mutates the underlying
  ANCHORS array or its order across repeated calls (the implementation
  is filter-then-sort, which is safe, but sort() mutates in place and this
  makes sure nothing upstream of it hands sort() the live array by mistake).

One real edge case worth flagging in review: listAnchors()'s `corridor`
parameter is matched against `Anchor.country`, not `Anchor.corridor` -
passing the literal corridor display string (e.g. "NGN (Nigeria)") matches
nothing, only a country name does. This doesn't bite in practice because
the only caller (src/app/(app)/anchors/page.tsx) always sends the country
name, but it's exactly the kind of gap a "no docs" refactor could hit
later, so it's covered by its own test with an explanatory comment rather
than silently left undocumented. Out of scope for this PR to rename/fix -
happy to open a follow-up if that's wanted.

route tests cover: 401 when unauthenticated, the default-amount happy path
with the correct estimatedFee on the cheapest anchor, corridor+assetCode+
custom amount together, an empty-but-200 result set, and the current
(unvalidated) behavior when `amount` isn't a number - documents that it
degrades to `null` over JSON rather than crashing, since there's no Zod
schema on this query param today.

Verified live via npm run dev: GET /api/anchors without a session cookie
returns 401 (confirmed the auth gate boots and behaves correctly). Could
not exercise the authenticated 200 path live in this sandbox specifically
for anchors, because getCurrentUser() calls out to Supabase after
verifying the JWT and Supabase isn't configured here (unrelated to this
PR - a signed session cookie alone doesn't get you further, the actual
business logic under test - listAnchors/estimateFee - has no DB
dependency at all and is fully covered by the 13 lib-level tests above).

npx vitest run: 18/18 new tests pass; full suite otherwise unaffected
(the 4 pre-existing files that fail on collection do so because of the
unrelated Northgate-Systems#527/Northgate-Systems#529 ReferenceError, reproduces on a clean main checkout).
npx eslint: 0 issues. npx tsc --noEmit: 0 new errors (same pre-existing
SafeUser + Northgate-Systems#527 errors elsewhere).