chore: add vitest, commit the lockfile, fix gitignore and docker install

Groundwork before pulling logic out of App.svelte.

Vitest runs in a node environment. Nothing under test needs a DOM, because
every module takes its dependencies as arguments.

package-lock.json is tracked now and the Dockerfile installs with npm ci,
so the nightly rebuild can't quietly land on different versions.

.gitignore: .DS_Store was anchored to the root and missed nested copies,
and dist/ wasn't ignored at all.

.gitignore

@@ -1,3 +1,3 @@
-/.DS_Store
+.DS_Store
 /node_modules
-/package-lock.json
+/dist