Add unit tests and CI for ponymail-mcp

The mcp/ponymail-mcp package shipped without tests or CI. This adds
both, using only built-in Node tooling so the dependency tree stays
unchanged.

- restrictions.test.js: 15 unit tests covering pattern grammar
  (prefix@, @domain, prefix@domain), env-var parsing edge cases
  (none, empty, mixed case, whitespace), case-insensitive input
  matching, restrictionFor/restrictionForAddress/isRestricted/
  restrictionError/listRestrictions, and falsy-input tolerance.
  Each test that exercises a different env spawns a child node
  process and re-imports restrictions.js, since RESTRICTED is
  captured at module load.
- auth.test.js: 8 unit tests for the session-persistence helpers
  (loadSession, clearSession). Each test runs in a child process
  with HOME pointed at a temporary directory so the on-disk
  session.json is fully isolated. Covers: missing file, fresh
  cookie, expired cookie, missing-timestamp behaviour, malformed
  JSON, missing cookie field, and clearSession idempotency. The
  interactive performLogin() flow (browser, local HTTP server,
  network validation) is out of scope for unit tests.
- package.json: adds `npm test` script using node:test with the
  spec reporter, and declares engines.node: >=20 (uses node:test
  built-in runner; no new deps).
- .github/workflows/ponymail-mcp-tests.yml: runs the suite on
  push/PR (path-filtered to mcp/ponymail-mcp/) on Node 20 and 22.
  Hardened: top-level `permissions: {}` (deny-all) with per-job
  contents: read, third-party actions pinned to commit SHAs with
  version comments, actions/checkout sets persist-credentials:
  false, 10-minute job timeout.

Generated-by: Claude Code (Claude Opus 4.7)