test(04-01): add SECU-03 assertion to reducer.test.ts — storage never written

- Added vi to import for spy capability
- SECU-03: dispatches all action types, asserts setItem never called on
  Storage.prototype (covers both localStorage and sessionStorage)
- All 9 reducer tests GREEN

src/store/reducer.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 import { wizardReducer } from './reducer';
 import { INITIAL_STATE, WizardState } from './types';
 
@@ -61,4 +61,17 @@ describe('wizardReducer', () => {
     wizardReducer(INITIAL_STATE, { type: 'SET_STEP', payload: 5 });
     expect(INITIAL_STATE.currentStep).toBe(before.currentStep);
   });
+
+  it('SECU-03: never writes to localStorage or sessionStorage', () => {
+    const setItemSpy = vi.spyOn(Storage.prototype, 'setItem');
+    // Dispatch every action type to cover all reducer branches
+    wizardReducer(INITIAL_STATE, { type: 'SET_STEP', payload: 1 });
+    wizardReducer(INITIAL_STATE, { type: 'SET_BACKEND_TYPE', payload: 'azureblob' });
+    wizardReducer(INITIAL_STATE, { type: 'SET_REMOTE_NAME', payload: 'test' });
+    wizardReducer(INITIAL_STATE, { type: 'SET_REMOTE_PARAMS', payload: { key: 'val' } });
+    wizardReducer(INITIAL_STATE, { type: 'SET_DEPLOYMENT', payload: { includeInstall: true } });
+    wizardReducer(INITIAL_STATE, { type: 'RESET' });
+    expect(setItemSpy).not.toHaveBeenCalled();
+    setItemSpy.mockRestore();
+  });
 });