test: cover untested emailDraftSchema and eventDraftSchema branches

[omkarwarik02]

Title:
test: cover untested emailDraftSchema and eventDraftSchema branches

Description:

Problem

packages/domain/src/index.ts has two schemas guarding what can be sent to Google (emailDraftSchema, eventDraftSchema), but a few of their validation branches had no direct test coverage:

• emailDraftSchema's rejection of multi-line subjects, and its cc/bcc/attachmentIds length limits, had zero tests anywhere in the suite.
• eventDraftSchema's requirement that timed (non-allDay) events carry an explicit UTC offset was only exercised incidentally by an unrelated all-day/timed mismatch test, not directly.

Change

Added tests/domain.test.ts with focused node:test cases for:

• email draft defaults (cc/bcc/attachmentIds default to [])
• rejecting subjects with \n/\r
• recipient/cc/bcc/attachment length limits
• malformed email addresses
• timed events missing a UTC offset vs. a valid one (Z and numeric offset)
• all-day events rejecting a full timestamp instead of a date
• end-before-or-equal-to-start rejection
• default calendarId/location/description
• proposalSchema discriminating on kind and validating nested data

No production code changed — test-only.

Testing

• pnpm lint — clean on the new file (ran biome check against tests/domain.test.ts directly; the full-repo pnpm lint reports pre-existing CRLF diffs across the whole tree from my local Windows checkout, unrelated to this change)
• pnpm typecheck — clean
• pnpm test — 166 tests, 165 pass; the one failure (computer-runner.test.ts, a Docker subprocess test) is a known Windows-only issue unrelated to this change (also called out in PR fix: handle Postgres pool errors instead of crashing #19)

[omkarwarik02]

Refs #40 — adds the test coverage discussed there, no production code changes.

[jerelvelarde]

Security review — no issues found (reviewed head cdbacdf)

• Test-only. It adds a single file, tests/domain.test.ts, and changes no production code.
• The tests are self-contained. They're pure schema assertions using node:test, with no network, filesystem, child processes or environment access.
• Adds coverage on a safety boundary. The tests pin the header-injection guard (rejecting CR/LF in email subjects), the recipient and attachment limits, and the UTC-offset requirement for timed events. Those schemas guard what can be sent to Google, so this coverage is welcome.

CI hasn't run on this PR yet.