npm test builds the site first, so a fresh clone passes

REGRESSION, and it had been failing since the split. `npm test` on this line never built `dist/`,
because `pretest` exists on main and was never ported here. Two suites read `dist/` — the replay
manifest check and the static build — and the manifest check runs BEFORE the suite that happens to
build. So on a clean tree the run failed with "no replay manifest was built", and passed only on a
machine where something had already run `build:web`.

That is exactly a fresh clone and exactly CI, which is the worst place for it to hide: locally it
looked intermittent, because whether it passed depended on whether `dist/` happened to be lying
around from a deploy.

Verified by deleting `dist/` and running: fails without this change, 636/636 with it.

Also syncs `package-lock.json`'s version field, stale at 0.4.8 since before the 0.4.9 line began.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FLnYR4XtXQNamYJXGYT8oC

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "station-master",
-  "version": "0.4.8",
+  "version": "0.4.9g",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "station-master",
-      "version": "0.4.8",
+      "version": "0.4.9g",
       "devDependencies": {
         "@types/node": "^26.1.2",
         "typescript": "^7.0.2"

package.json

@@ -9,6 +9,7 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
+    "pretest": "node scripts/build-web.ts",
     "test": "node --test test/**/*.test.ts",
     "build:web": "node scripts/build-web.ts",
     "serve:web": "node scripts/build-web.ts && npx --yes http-server dist -p 8080 -c-1",