I fixed `parseIsoDate`, and `npm test` now passes.

**The bug:** the leap-year check in `src/parse-iso-date.mjs` only tested `year % 4 === 0`. That treated century years like 1900 and 2100 as leap years, so `"1900-02-29"` was accepted when it should return `null`.

**The fix:** I changed that one line to the full Gregorian rule from the contract:
```js
const leap = year % 400 === 0 || (year % 4 === 0 && year % 100 !== 0);
```

I also tried some extra cases from the contract by hand, and all behaved correctly:
- 2000 and 0000 count as leap years; 2100 doesn't.
- Days and months out of range return `null`.
- Strings with leading spaces or a trailing newline, full-width digits, `String` objects, `null` and `undefined` all return `null`.

No other files were changed: nothing under `protected/` or `test/`, and I didn't write `notes/attempt.txt`.