[hannahcspl]

Description

The Database Explorer query policy was embedded in the session-starting extension module, making it difficult to test directly. This change extracts the existing behavior into an importable module and adds focused Vitest coverage, without changing which queries the policy accepts or rejects.

Related Issue

Related to #164

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 📚 Documentation update
• 🧪 Test update
• 🔧 Refactor (no functional changes)

Changes Made

• Extract the existing query normalization and validation into an importable module used by both extension entry points.
• Include only the Database Explorer test path in Vitest discovery.
• Add focused tests for supported query normalization and invalid/direct non-read input handling.

Testing

Data Layer Changes

• Ran npm run test:unit - all tests pass (52 tests across 5 files)
• Added/updated Vitest tests for data-layer changes (N/A; this does not change the application data layer)
• Generated a migration (npm run db:generate) for any schema change (N/A; no schema change)

Frontend Changes

• Ran npm run test:e2e - all tests pass (N/A; no UI changes)
• Added data-testid attributes to interactive elements (N/A; no UI changes)
• Verified build succeeds (npm run build) (N/A; no UI changes)

Checklist

• My code follows the project's coding standards
• I have used explicit TypeScript types for function parameters and return values (N/A; extension and tests are JavaScript modules)
• I have built the UI with Astro components and Tailwind CSS utility classes (dark theme) (N/A; no UI changes)
• I have updated documentation (README, instruction files) if needed (no documentation changes were needed for this test-only scope)
• My changes are focused on a single concern
• I have written clear commit messages explaining what and why

Additional Notes

This PR covers the test seam and focused policy tests only. It does not change the query policy's behavior or claim complete coverage of the Database Explorer's read-only contract.

Validation also passed: npm run lint and npm run typecheck:all.