I fixed `luhnValid` in `src/luhn-valid.mjs`, and `npm test` now passes.

**The bug:** the loop doubled the rightmost digit, but Luhn leaves the rightmost digit alone and doubles every second digit after it, moving left. The fix was one line: `doubleDigit` now starts as `false` instead of `true`. The rest of the function already matched `protected/api-contract.json`.

**Checks:** besides the test file, I tried a few edge cases from the contract and they all came out right:
- Non-strings (`null`, numbers, arrays, `String` objects) are rejected.
- Strings shorter than 12 or longer than 19 characters are rejected.
- Strings with spaces, newlines or non-ASCII digits are rejected.
- A known valid number padded with leading zeros is accepted.

I didn't change any other files, including anything under `protected/` and `notes/attempt.txt`.