Add automated tests for the 25% pricing formula and $25/$15 shipping thresholds

Launch gate (design doc §5/§8) requires automated tests for both; the repo
had zero test infra until now. PHPUnit + Brain Monkey, run via `make test`
against the existing wordpress dev container.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg

Makefile

@@ -21,7 +21,7 @@ $(shell grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' .env.$(ENV) > $(COMPOSE_ENV_
 COMPOSE = docker compose -p bookstore-$(ENV) -f docker-compose.yml -f docker-compose.$(ENV).yml --env-file $(COMPOSE_ENV_FILE)
 CLEANUP = trap 'rm -f $(COMPOSE_ENV_FILE)' EXIT;
 
-.PHONY: up down ps logs shell wp deploy backup
+.PHONY: up down ps logs shell wp test deploy backup
 
 up:
 	$(CLEANUP) $(COMPOSE) up -d --build
@@ -43,6 +43,17 @@ shell:
 wp:
 	$(CLEANUP) $(COMPOSE) exec -u www-data wordpress wp $(ARGS)
 
+# bookstore-core's PHPUnit suite; composer install is idempotent so this
+# stays a single target rather than a separate "test-install" step. The
+# plugin dir is bind-mounted from the host at the host user's uid, which
+# www-data (uid 33 in the container) can't write into — install as root
+# (same "-u root yourself for one-off root debugging" pattern as `shell`
+# above), then chown vendor/composer.lock back to the host uid/gid so
+# they stay normal host-owned files afterward, not root-owned.
+test:
+	$(CLEANUP) $(COMPOSE) exec -u root wordpress bash -c \
+		"cd wp-content/plugins/bookstore-core && composer install --no-cache && chown -R $(shell id -u):$(shell id -g) vendor composer.lock && vendor/bin/phpunit"
+
 deploy:
 	$(CLEANUP) ./deploy/deploy.sh $(ENV)