test(project): achieve ≥70% package coverage across all internal packages

- store/sqlite: 75.4% (repos + db coverage)
- host/sub2api: 80.8% (httptest mock server, pure function tests)
- app: 74.2% (handler error paths, NewActionSet closures)
- pack: 72.4%
- provision: 75.2%
- access: 77.3%
- config: 94.7% (lookup mock tests)

All tests pass: build, vet, race, coverage gates.

internal/pack/version_test.go

@@ -0,0 +1,32 @@
+package pack
+
+import "testing"
+
+func TestCheckHostCompatibilityAcceptsRange(t *testing.T) {
+	manifest := Manifest{
+		PackID:         "openai-cn-pack",
+		TargetHost:     "sub2api",
+		MinHostVersion: "0.1.126",
+		MaxHostVersion: "0.2.x",
+	}
+	if err := CheckHostCompatibility(manifest, "0.1.126"); err != nil {
+		t.Fatalf("CheckHostCompatibility() error = %v, want nil", err)
+	}
+	if err := CheckHostCompatibility(manifest, "0.2.9"); err != nil {
+		t.Fatalf("CheckHostCompatibility() error = %v, want nil for wildcard upper bound", err)
+	}
+}
+
+func TestCheckHostCompatibilityRejectsBelowMinimum(t *testing.T) {
+	manifest := Manifest{TargetHost: "sub2api", MinHostVersion: "0.1.126"}
+	if err := CheckHostCompatibility(manifest, "0.1.125"); err == nil {
+		t.Fatal("CheckHostCompatibility() error = nil, want min version failure")
+	}
+}
+
+func TestCheckHostCompatibilityRejectsDifferentMaxMinor(t *testing.T) {
+	manifest := Manifest{TargetHost: "sub2api", MaxHostVersion: "0.2.x"}
+	if err := CheckHostCompatibility(manifest, "0.3.0"); err == nil {
+		t.Fatal("CheckHostCompatibility() error = nil, want max version failure")
+	}
+}