Add comprehensive unit tests for modules/hibp

[Seanstoppable]

Summary

Adds unit tests for the modules/hibp (Have I Been Pwned) package, which previously had 0% test coverage.

Coverage: 0% -> 94.2%

What's tested

• Status/Breach: NewStatus, HasBeenCompromised, Len, BreachDate (table-driven, including malformed dates)
• Settings: HasSince, SinceDate, NewSettingsFromYAML (colors, since, refresh-interval floor), ConfigText
• Widget: sinceDateForTitle, content() (color/status logic, error state, since-date title), Fetch, Refresh, NewWidget
• Client (mocked with net/http/httptest): fullURL, validateHTTPResponse, parseResponseBody, filterBreaches, and fetchForAccount covering success, 404/no-breach, rate-limit (429), 401/402 API errors, malformed JSON, and simulated network errors

Notable changes

• Made apiURL a package variable (was a const) so tests can redirect requests to an httptest server.
• Fixed a real bug found while testing error paths: fetchForAccount was swallowing network/read errors - it checked getErr/readErr but returned the already-nil outer err, so network failures silently returned (nil, nil) instead of an error. Also added a missing response.Body.Close().

Validation

• go build ./... passes
• go test ./modules/hibp/... -cover passes (94.2% coverage)
• golangci-lint run ./modules/hibp/... reports no real issues; only gofmt warnings remain, which are pre-existing CRLF line-ending artifacts reproducible on unrelated, untouched modules (e.g. modules/clocks) - out of scope for this change.