I fixed `romanToInt` in `src/roman-to-int.mjs`, and `npm test` now passes.

**The bug:** the function added up every symbol, so it never subtracted. `IV` came out as 6 instead of 4, and `MCMXCIV` as 2216 instead of 1994.

**The fix:** I replaced the final loop with the left-to-right scan described in the contract. If a symbol is worth less than the one right after it, it's subtracted; otherwise it's added. The input checks that come before it (type, allowed characters, canonical-form pattern) already matched the contract, so I left them alone.

Beyond the test, I spot-checked some edge cases and they behave as the contract says:
- `MMMCMXCIX` returns 3999, `IX` returns 9 and `CD` returns 400.
- These are all rejected with `null`: `iv`, ` IV`, `IIII`, `VX`, `MMMM`, an empty string, `null`, and `new String("IV")`.

No other files were changed, and I didn't write `notes/attempt.txt`.