test(frontend): pay down the coverage regression from #274/#263/#280 with lib tests

WHY THIS MATTERS

Main's "Frontend build and tests" job has been red for everyone:
statements 52.14% vs the 54% floor and branches 62.57% vs 73%. A
coverage ratchet only works if regressions are paid down with tests -
if we lower the floor instead, the ratchet becomes a decoration and
every future untested merge quietly erodes the suite. This commit
restores green by testing the code that caused the drop, then re-arms
the ratchet at the new level.

WHAT HAPPENED

The ratchet floors were measured in #255 (2266446) before three merges
landed untested code inside the gated scope (src/app/lib/**):

- #263 (db-pagination) + #274 (folder-grouped tabular reviews) grew
  mikeApi.ts's listTabularReviews/listTabularReviewIds into
  query-string builders with seven conditional params each, added the
  document_grouping field, the uploadReviewDocument orchestration, and
  the tabular chat/cell endpoints - nearly all unexercised. Lines
  1044-1456 were the bulk of the uncovered report.
- #280 (workflow slash triggers) leans on the workflow endpoints
  (listWorkflows feeds the slash menu), which were also untested.

Because coverage is a global percentage over the gated files, adding
untested statements/branches anywhere in scope dilutes the totals even
though no tested line got worse.

HOW THE FIX WORKS

Extend the existing mikeApi.test.ts fetch/session mocking pattern to
the regressed surface, asserting behavior (URLs, methods, exact
payloads, error contracts), not just execution:

- listTabularReviews/listTabularReviewIds: every pagination knob
  serialized under its snake_case name, scope="all" omitted (backend
  default), abort signals forwarded, and the ids query scoped
  identically to the list query - the invariant that keeps
  select-all-then-delete from deleting reviews the user cannot see.
- createTabularReview/updateTabularReview: document_grouping (the #274
  field) passes through unchanged; PATCH sends only the given fields.
- uploadReviewDocument: project vs standalone upload routing, and that
  the follow-up PATCH appends to existing document_ids instead of
  replacing them (the review-shrinking failure mode).
- Multipart uploads: FormData with auth header only (a manual JSON
  content type would break the boundary), optional filename field, and
  the plain-Error-with-response-text failure contract.
- Tabular chats/cells, workflow list/hide/unhide, query and payload
  defaults (getDocumentUrl version param, createChat "{}" body,
  parent_folder_id null-vs-undefined, empty error bodies).
- supabase.ts: importing without env vars fails loudly at module load -
  the desired crash-at-startup behavior for a misconfigured build.
- deleteTabularReviewsWithConcurrency: empty input short-circuits;
  concurrency<=0 clamps to one worker instead of silently deleting
  nothing.
- utils.diceCoefficient: sub-bigram inputs score 0.

Coverage moves from 52.14/62.57/34.67/52.41 (stmts/branch/funcs/lines)
to 81.18/98.24/55.64/79.18. Per the ratchet's own rule ("floors only go
up: when you add tests, raise them in the same PR"), the floors move to
79/96/53/77 - about two points under the new measurement, so one small
innocent addition doesn't instantly re-redden main, while a real drop
still fails CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>