test: add Cortex test suite (77 tests, no LLM calls)

Tests cover:
  - Smoke: /health, /auth/status, /distill/status (test_health.py)
  - Persona validation: path traversal, bad names, list_personas (test_persona.py)
  - Chat API: persona routing, session persistence, error handling (test_api_chat.py)
  - Files API: ALLOWED set enforcement, read/write, missing files (test_api_files.py)
  - Webhooks: NC Talk HMAC accept/reject, Google Chat JWT (test_webhooks.py)
  - Tools: scratch read/write/append/clear, tasks CRUD, cron parser + tools (test_tools.py)
  - Security: path traversal, replay attack, known gaps documented (test_security.py)

All LLM calls mocked — suite runs in ~1.4s.
Run: cd cortex && .venv/bin/pytest

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/tests/test_health.py

@@ -0,0 +1,34 @@
+"""
+Basic smoke tests — if these fail, nothing else matters.
+"""
+import pytest
+
+
+@pytest.mark.anyio
+async def test_health(client):
+    r = await client.get("/health")
+    assert r.status_code == 200
+    assert r.json()["status"] == "ok"
+
+
+@pytest.mark.anyio
+async def test_auth_status(client):
+    r = await client.get("/auth/status")
+    assert r.status_code == 200
+    data = r.json()
+    assert "claude" in data
+    assert "gemini" in data
+    assert "ok" in data["claude"]
+
+
+@pytest.mark.anyio
+async def test_distill_status(client):
+    r = await client.get("/distill/status")
+    assert r.status_code == 200
+    assert "enabled" in r.json()
+
+
+@pytest.mark.anyio
+async def test_unknown_route_404(client):
+    r = await client.get("/does-not-exist")
+    assert r.status_code == 404