Add tests for dotenv helpers and URL-safe object key tokens

[cursor]

Summary

Adds Vitest coverage for shared .env parsing/mutation helpers and S3 object key token encoding used in vault flows.

Risky behavior now covered

• parseDotenv / removeDotenvKey / appendDotenvKey (src/lib/dotenv-parse.ts): quoted values, CRLF, comment/blank handling, duplicate key detection, validation errors (empty key, = in key, # prefix, multiline key/value), and quoting/escaping when appending values that contain spaces or quotes—reduces risk of corrupting secrets files or accepting invalid variable names in the file workspace.
• encodeObjectKeyToken / decodeObjectKeyToken (src/lib/key-token.ts): round-trip correctness, URL-safe alphabet (no +, /, padding =), and a short key case that exercises base64 padding—guards regressions in query-param safe S3 key handling.

Test files added/updated

• src/lib/dotenv-parse.test.ts (new)
• src/lib/key-token.test.ts (new)

Why this reduces regression risk

These modules are pure, high blast-radius utilities: mistakes break secret file editing, GitHub Action env extraction (same parse semantics elsewhere), or routing to the wrong S3 object. The tests are deterministic, node-only, and assert explicit outcomes without snapshots.

Validation

• npm run test (full Vitest suite) — all tests passed.