test: cover stats plugin route behavior

[xingxi0614-cpu]

/claim #71

Summary

• Added focused Vitest coverage for StatsPlugin registration.
• Covered middleware capture of config/dataSource.
• Covered admin stats response merging rpc.getStatistics() with registry.currentPlugins().
• Covered non-admin rejection before statistics are read.

This is a test-only PR with no production behavior changes.

Verification

• pnpm vitest --run plugins/stats/index.test.ts -> 3 tests passed
• pnpm exec prettier --check plugins/stats/index.test.ts -> passed
• git diff --check -> passed
• pnpm vitest --run -> existing baseline still has 4 failing RLS tests in src/rls/index.test.ts; the new stats test passes in the full run

AI-assisted with Codex; I reviewed the diff and kept the scope to the Stats plugin coverage slice.

[xingxi0614-cpu]

Follow-up verification/demo note for this focused test-only slice:

• pnpm vitest --run plugins/stats/index.test.ts -> 1 file passed, 3 tests passed
• pnpm exec prettier --check plugins/stats/index.test.ts -> all matched files use Prettier code style
• git diff --check origin/main..HEAD -> no whitespace errors

What the test demonstrates:

1. StatsPlugin.register() wires the middleware and /_internal/stats route.
2. Admin requests return rpc.getStatistics() merged with registry.currentPlugins().
3. Non-admin requests are rejected before statistics/plugin registry reads happen.

No production behavior was changed; this is intentionally scoped to plugins/stats/index.test.ts.