fix: Install web subdirectory dependencies, set NODE_ENV for tests, and standardize hostname in server tests.

web/src/server.test.ts

@@ -58,6 +58,7 @@ mock.module("../../bot/lib/clientStats", () => ({
 
 describe("WebServer Security & Limits", () => {
     const port = 3001;
+    const hostname = "127.0.0.1";
     let serverInstance: WebServerInstance | null = null;
 
     afterAll(async () => {
@@ -67,8 +68,8 @@ describe("WebServer Security & Limits", () => {
     });
 
     test("should reject more than 10 concurrent WebSocket connections", async () => {
-        serverInstance = await createWebServer({ port, hostname: "localhost" });
-        const wsUrl = `ws://localhost:${port}/ws`;
+        serverInstance = await createWebServer({ port, hostname });
+        const wsUrl = `ws://${hostname}:${port}/ws`;
         const sockets: WebSocket[] = [];
 
         try {
@@ -95,9 +96,9 @@ describe("WebServer Security & Limits", () => {
 
     test("should return 200 for health check", async () => {
         if (!serverInstance) {
-            serverInstance = await createWebServer({ port, hostname: "localhost" });
+            serverInstance = await createWebServer({ port, hostname });
         }
-        const response = await fetch(`http://localhost:${port}/api/health`);
+        const response = await fetch(`http://${hostname}:${port}/api/health`);
         expect(response.status).toBe(200);
         const data = (await response.json()) as { status: string };
         expect(data.status).toBe("ok");
@@ -105,7 +106,7 @@ describe("WebServer Security & Limits", () => {
 
     describe("Administrative Actions", () => {
         test("should allow administrative actions without token", async () => {
-            const response = await fetch(`http://localhost:${port}/api/actions/reload-commands`, {
+            const response = await fetch(`http://${hostname}:${port}/api/actions/reload-commands`, {
                 method: "POST"
             });
             // Should be 200 (OK) or 500 (if underlying service fails, but NOT 401)
@@ -114,7 +115,7 @@ describe("WebServer Security & Limits", () => {
         });
 
         test("should reject maintenance mode with invalid payload", async () => {
-            const response = await fetch(`http://localhost:${port}/api/actions/maintenance-mode`, {
+            const response = await fetch(`http://${hostname}:${port}/api/actions/maintenance-mode`, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json"