test: add synthetic fixtures and dataset change checks

[Yuky-499]

What

Adds reproducible synthetic fixtures for the intelligent-analysis user-detail API and a PR check for dataset changes. A new/modified dataset under apps/web/public/test/ or apps/web/test-fixtures/ must either match the checked-in generator or have an exact-path SHA-256 review record describing its purpose, provenance, and publication basis.

This is a preventive follow-up to #386 and merged PR #406. It does not identify a new incident, change the existing path validation from #387, or remove existing runtime resources.

Changes

• Three deterministic, manually authored fixtures use fictional identifiers and reserved example.test contact values. Seventeen integration cases call the real user-detail handler against temporary files, covering both working-directory layouts, main/fallback/backup reads, zero/null/empty values, cache headers, missing/malformed data, method validation, and traversal rejection.
• A dependency-free dataset checker reviews committed changes from the merge base. It covers all file extensions, renames/copies and type changes, rejects stale hashes/symlinks/oversized files, and emits fixed error messages without dataset values or filenames. Unchanged legacy dataset contents are not scanned.
• A separate read-only PR workflow tests the checker and checks the proposed merge with a sparse depth-2 checkout. It does not install packages, initialize submodules, or check out the full public dataset collection. Existing build/test CI remains unchanged.
• docs/synthetic-fixtures.md maps known runtime consumers, documents generation and per-file review, and makes the initial scope and human review requirements explicit.

Review records are declarations for maintainer review, not automated proof of consent or a general personal-data detector. Source-embedded datasets, other public directories, external data, and historical cleanup remain outside this change. Existing API implementation, static assets, dependencies and i18n gitlink are unchanged.

Validation

• yarn test:ci --runInBand: 25 suites / 119 tests passed, including 17 new real-filesystem API cases.
• yarn fixtures:test: 19 tests passed, including rename/copy, stale hash, redacted diagnostics, symlink/size limits, advancing base branches, and a sparse depth-2 merge checkout.
• node scripts/fixtures/generate.js --check: reproducible bytes verified.
• Changed-file ESLint and targeted TypeScript checks passed; workflow YAML parsed and checkout settings checked.
• Full Next.js build was attempted but blocked by this local sparse checkout's missing @public/data/collections—menus.json at src/common/collectionsI18n.tsx:3. A full application build is not claimed.

Based on upstream main at 75d90fc41a74c8ceaa68592d6db0d25779e44e8d.

[vercel]

@Yuky-499 is attempting to deploy a commit to the codersett's projects Team on Vercel.

A member of the Team first needs to authorize it.