fix: repair 16 failing tests across utility-library modules

[stooit]

Summary

Repairs all 16 failing tests across the 5 utility modules so the full suite passes (60 pass, 0 fail). No test files were modified and no dependencies were added — each fix targets the documented root cause the tests exercise.

Changes

• src/calculator.ts — divide throws Error("Division by zero") when the divisor is 0 (previously returned Infinity). Guard placed before the division so -0 divisors are also caught.
• src/string-utils.ts
  • wordCount splits the trimmed string on /\s+/, so runs of consecutive spaces no longer count as phantom words.
  • truncate implemented: returns input unchanged when within maxLength; otherwise reserves 3 chars for the ellipsis, cuts back to the last word boundary within budget (hard cut when no space), and appends "...". Result is always <= maxLength.
• src/task-manager.ts — remove returns true/false on hit/miss; update returns false for unknown ids and applies only explicitly-present fields; sortBy sorts a copy using explicit priority/status rank maps and ascending createdAt, relying on stable sort for tie order.
• src/date-utils.ts — formatRelative rounds hours→days (Math.round(abs/24)) so exactly 36h reads as "2 days ago"; abs keeps past/future symmetric.
• src/validator.ts — isEmail accepts dot-separated subdomains and long alphabetic TLDs (e.g. .museum) with hyphen-anchored labels; isUrl drops the spurious empty-port check while keeping the http/https allowlist.

Verification

• bun test → 60 pass, 0 fail (5 files)
• npx tsc --noEmit → clean
• Only the 5 src/ files changed; no test files touched.

Review notes (out of scope — tests do not require)

A review pass flagged edge cases beyond the test suite, left unaddressed to keep this change tightly scoped to "fix only what the tests require". Worth a follow-up if these paths matter:

1. truncate + non-ASCII — slice operates on UTF-16 code units, so a budget landing mid-surrogate-pair can emit a lone surrogate (e.g. splitting an emoji). Use code-point-safe slicing if inputs may contain non-BMP characters.
2. update cannot clear an optional field — the !== undefined guard means update(id, { description: undefined }) is a no-op; there's no way to unset a description. Switch to an "description" in changes check if clearing should be supported. (Semantic decision, deliberately left to maintainers.)
3. truncate tiny budget — when maxLength < ~4 the ellipsis is dropped, so truncated output is indistinguishable from a complete string. Defensible but undocumented.
4. isEmail / isUrl are validators, not security guards — isEmail accepts anything non-space in the local part (not an XSS escaper); isUrl returns true for http://localhost:3000 and internal hosts (not an SSRF guard). If either validates untrusted input the server then acts on, add the appropriate allowlist/escaping separately.

Assumptions

• "Fix only what the tests require" was treated as the hard boundary — the review findings above were documented rather than actioned to avoid scope creep and unrequested semantic changes.