/claim #71

Summary

• Add focused Vitest coverage for isQueryAllowed in the allowlist module.
• Cover disabled enforcement and admin bypass paths that should avoid loading the allowlist.
• Cover normalized SQL matching with a trailing semicolon, rejected query logging, and missing SQL error handling.

Verification

• ./node_modules/.bin/vitest.cmd run src/allowlist/index.test.ts
• ./node_modules/.bin/vitest.cmd run currently has unrelated pre-existing failures in src/rls/index.test.ts.