Add pirate treasure tracking REST API

[Copilot]

Node.js Express API for CRUD operations on pirate treasure, backed by an in-memory store.

API

• POST /api/treasures — create treasure (201)
• GET /api/treasures — list all (200)
• GET /api/treasures/:id — get by ID (200 / 404)
• DELETE /api/treasures/:id — delete by ID (204 / 404)
• GET / — health check

Data model

{ "id": "uuid", "name": "string", "value": 0, "location": "string", "dateFound": "string" }

IDs generated via crypto.randomUUID() (no uuid package — v13 is ESM-only, incompatible with Jest/CJS).

Validation & security hardening

• Type + presence checks on all fields; empty strings rejected
• Number.isFinite() guard rejects NaN/Infinity/negative values
• HTML tag stripping on string inputs (O(n) char walk, no regex) to mitigate stored XSS
• Error-handling middleware catches malformed JSON — returns 400 JSON instead of leaking stack traces

Project structure

src/
├── app.js              # Express app (exported, no listen — testable)
├── server.js           # Entry point, binds to PORT
├── routes/treasures.js # Router with all handlers
└── data/store.js       # In-memory array + resetTreasures()
__tests__/
└── treasures.test.js   # 20 tests (supertest, Jest)

App/server split so supertest can exercise routes without binding a port. Store reset uses treasures.length = 0 to preserve module-level references across test isolation.