test: cover dotenv helpers and object key token encoding

[cursor]

Summary

Adds focused Vitest coverage for .env parsing/editing helpers used by the vault file workspace and secrets TRPC router, and for URL-safe S3 object key tokens used with access tokens.

Risky behavior now covered

• parseDotenv / removeDotenvKey / appendDotenvKey (src/lib/dotenv-parse.ts): comment and blank handling, quoted values, CRLF, key removal without stripping unrelated keys, append formatting and validation (empty key, =, # prefix, newlines, duplicates), and quoting rules for values that need escaping.
• encodeObjectKeyToken / decodeObjectKeyToken (src/lib/key-token.ts): round-trip for typical paths, Unicode keys, empty string, and a byte pattern that would produce +// in standard base64 (URL-safety regression guard).

Test files added/updated

• src/lib/dotenv-parse.test.ts (new)
• src/lib/key-token.test.ts (new)

Why this reduces regression risk

These modules sit on high-blast-radius paths: wrong parsing or key edits corrupt stored secrets; broken token encoding breaks CI/API links that pass object keys in query strings. The tests lock in current behavior so refactors or parser tweaks surface immediately without needing the full app or S3.

Validation

• npm run test (full Vitest suite) — all tests pass; deterministic, no network or DB.