test(gui): add Streamlit AppTest layer (139 tests)

Until now every test ran against core or the CLI; the Streamlit GUI
was verified by hand. This commit adds tests/gui/ — 139 AppTest-
driven tests behind a 'gui' marker so the quick loop
(``pytest -m 'not gui'``) stays at 1777 tests / ~10s while
``pytest`` runs everything (1916 / ~14s).

Coverage:
- test_smoke.py (59): every page renders in EN and ES, expected
  substring present, sidebar selector mounted.
- test_chrome.py (18): language selector flips session state and
  re-renders; quit button + farewell strings localize; tool-card
  names use the active language.
- test_gate.py (9): require_normalization_gate no-op / warning /
  short-circuit / hash-mismatch invariants; warning + button
  localized.
- test_workflows.py (14): happy path per Ready tool — stash
  upload, render, find primary action, verify result lands in
  session state.
- test_dedup_review.py (8): Accept All / Reject All / Clear
  Decisions wire through to review_decisions; apply_review_decisions
  semantics (keep-all, merge, column override).
- test_advanced_panels.py (15): config_panel widget defaults and
  options (algorithm, threshold, survivor rule, merge, multiselects,
  config save/load).
- test_errors.py (4): garbage / empty / single-column uploads don't
  crash; duplicate-target mapping raises InputValidationError.
- test_findings_panel.py (12): driven via a small standalone harness
  page so we test the component without faking a file_uploader. EN
  + ES strings, per-tool grouping, open-tool button label, untargeted
  expander, severity summary.

Shared infrastructure in tests/gui/conftest.py:
- ``stash_upload`` / ``stash_upload_without_gate`` — populate
  session_state to pre-pass or block the gate.
- ``with_language`` — set ``ui_lang`` before run().
- ``collected_text`` — flatten title/caption/markdown/etc. into
  one string for substring assertions.
- Auto-marking: every test in tests/gui/ gets ``@pytest.mark.gui``
  via ``pytest_collection_modifyitems``, so the marker isn't
  per-test boilerplate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/gui/_findings_panel_harness.py

@@ -0,0 +1,44 @@
+"""Test harness page for ``render_findings_panel``.
+
+A standalone Streamlit page module the AppTest layer can drive
+directly. Renders the findings panel with whatever findings live in
+``st.session_state["test_findings"]`` so test code can inject a list
+and inspect what's rendered, without having to fake a file_uploader
+widget.
+
+Lives next to its test file so it ships with the GUI test layer and
+never gets confused with a real page.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import streamlit as st
+
+# Same sys.path bootstrap as the real pages so ``src.*`` imports work
+# regardless of how AppTest invokes the script.
+_project_root = Path(__file__).resolve().parent.parent.parent
+if str(_project_root) not in sys.path:
+    sys.path.insert(0, str(_project_root))
+
+
+# ``st.page_link`` requires a multipage-app context (Streamlit looks up
+# the target page's URL from the app's PagesManager). AppTest doesn't
+# wire that up for a standalone page, so any ``page_link`` call raises
+# ``KeyError: 'url_pathname'`` here. We swap it for a markdown stub
+# that renders the label inline — same observable text, no nav, no
+# crash.
+def _page_link_stub(page: str, *, label: str, **_kwargs) -> None:
+    st.markdown(f"[{label}]")
+
+st.page_link = _page_link_stub  # type: ignore[assignment]
+
+from src.gui.components import hide_streamlit_chrome, render_findings_panel
+
+st.set_page_config(page_title="findings test", page_icon="🧪", layout="wide")
+hide_streamlit_chrome()
+
+findings = st.session_state.get("test_findings", [])
+render_findings_panel(findings)