fix: quote non-identifier keys in planToJs arg rendering

What

Fix planToJs in apps/web/lib/plan-to-js.ts so it quotes call-arg object keys that aren't valid identifier names. Previously a legal validated script carrying a key with a space, dot, or hyphen (permitted by the args schema's z.record(z.string(), ...)) rendered as syntactically invalid JS: { foo bar: 1 } is a SyntaxError.

Why

planToJs renders a stored plan back to its JS surface for display and authoring. Its output should be valid JS for every plan the engine can store. Identifier keys, reserved words, numeric-string keys, and unicode identifiers already render correctly and stay bare; only non-identifier keys were broken.

Test coverage

apps/web had no test runner, so this renderer had zero regression coverage. This PR:

• adds a vitest seam to apps/web (vitest ^3.2.0, matching packages/callscript, plus a test script) so the workspace pnpm test covers both packages
• adds apps/web/lib/plan-to-js.test.ts asserting identifier/reserved-word/unicode keys stay bare, non-identifier keys are quoted, the output always parses as valid JS, and rendered args round-trip through eval to the original value

Verified locally: the regression test fails against the pre-fix code (SyntaxError: Unexpected identifier 'bar') and passes with the fix. Full pnpm test, pnpm typecheck, and pnpm build are green; biome check is clean over all tracked files.

Fixes #7