Address CodeRabbit review: harden CI token handling, fail loud on no tests

- Set persist-credentials: false and scope the workflow token to
  contents: read, since this job runs pull_request-triggered installs
  and tests from potentially untrusted forks (flagged by zizmor;
  matches the permissions: block already used in black.yml).
- Drop --passWithNoTests so a broken test-discovery config fails CI
  loudly instead of silently reporting success with zero tests run —
  exactly the failure mode this PR exists to prevent.

Left actions/setup-node@v3 as-is: CodeRabbit flagged it as unsupported,
but this repo's own Linting-Precommit workflow uses the same action
version and succeeded as recently as 2026-08-03, so the claim doesn't
hold for this repo's actual runners.

Author: blockgroot

.github/workflows/web-server-tests.yml

@@ -10,13 +10,18 @@ on:
     paths:
       - 'web-server/**'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
 
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Setup Node.js 22
       uses: actions/setup-node@v3
@@ -28,5 +33,5 @@ jobs:
       working-directory: web-server
 
     - name: Run tests
-      run: npx jest --watchAll=false --passWithNoTests
+      run: npx jest --watchAll=false
       working-directory: web-server