chore: Add backend coverage and mutation testing harness

[jeromevdl]

Summary

• measure backend coverage in CI and retain detailed reports
• compare PR coverage with the latest successful main baseline
• add Stryker mutation testing across backend domains
• run an informational mutation pilot on changed backend files

Mutation PR pilot

• mutates entire changed production files
• ignores static mutants
• skips draft PRs
• cancels obsolete runs after new pushes
• stops mutation execution after 30 minutes
• publishes partial results after timeout
• never blocks a PR because of surviving mutants
• exposes HTML/JSON reports as workflow artifacts

Validation

• 2,498 backend tests passing
• 601 shared tests passing
• sso-token: 23 mutants, 78.26% mutation score
• lint, formatting, secret scanning and package audits passing

Follow-up verification

This PR adds the coverage reporting workflow, but GitHub only runs a workflow_run workflow after it exists on main.

After this PR is merged, the next PR modifying backend code must confirm that:

• the coverage comment is posted on the correct PR;
• it lists the backend files modified by that PR;
• it compares their coverage against the latest successful run on main.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.