test(coverage): slack/policies-id/webhooks-id/scan-GET routes + repo-bundle/policy-service lib

[LanNguyenSi]

What

Closes the highest-risk residual test-coverage gaps in depsight after #86 (which covered safe-fetch, the tokens routes, webhooks/policies route exemplars, and the CI coverage ratchet). Adds 36 vitest tests across 6 previously-untested targets, plus per-file coverage thresholds.

Covered

Each target asserts the success path AND every failure/edge branch; the guard mutations were independently killed by a reviewer.

• app/api/slack/route.ts (GET/POST/DELETE): auth 401, missing webhookUrl 400, SSRF block (assertPublicUrl rejects SsrfBlockedError, upsert not called), invalid minSeverity 400, upsert/delete success.
• app/api/policies/[id]/route.ts (GET/PUT/DELETE): auth 401, not-found 404, the three PUT validation 400s (type/severity/rule), DELETE 404.
• app/api/webhooks/[id]/route.ts (DELETE/PATCH): auth 401, ownership 404 on both methods, explicit enable/disable, and toggle.
• app/api/scan/route.ts (GET, added to the existing file): auth 401, missing repoId 400, scan:null, full scan with advisories.
• lib/export/repo-bundle.ts: getMissingExportScans across all scan-presence combinations, and buildRepoExportArchive (missing-scan throw plus real ZIP byte output).
• lib/policy/service.ts: all 6 CRUD functions including the userId-scoped IDOR / not-found branches (update, delete, and toggle ownership all pinned).

Verification

• 411 tests pass (was 375). npm run test:coverage is green with the new per-file thresholds enforced, negative-control verified (each floor raised above measured produced a hard build failure, then restored).
• An independent reviewer ran 15 source mutations across all 6 targets; every security and validation guard kills a test (auth gates, SSRF reject, the three PUT validations, ownership 404s, IDOR where-clauses). The one surviving mutation, togglePolicy userId-scoping, was folded into a fix in this PR.
• lint: 0 errors. tsc --noEmit: clean.

Deferred to follow-up

This batch is the high-security-density subset. Still untested, tracked by the depsight test-coverage umbrella and a follow-up task: dependabot/* routes, ci/analytics routes and lib modules, the export/route 5-branch flow, ci/sync and ci/ingest, the pr-scan/repos-sync/deps/license/sbom/history/me/overview routes, lib/cron/auto-scan, lib/pr/pr-scanner, lib/github, the mcp tool handlers, the mint-api-token CLI, and the prisma DB layer in lib/export/repo-bundle.ts (loadRepoExportData IDOR plus the scan loaders, out of this PR's pure-function scope).

Refs: tc-audit-2026-06-27 (depsight test-coverage umbrella)