test: raise API coverage to 99.88% of lines and 100% of branches

[bgard68]

Raises API coverage from 86.51% of lines / 64.69% of branches to 99.88% / 100%, and the suite from 97 tests to 289. All green.

Tooling

• coverlet.collector on both test projects, configured by coverlet.runsettings at the repository root: only the four TodoApp.* assemblies, auto-properties skipped.
• Emits coverlet JSON as well as Cobertura, because the two suites have to be merged. Cobertura records only a per-line branch percentage, so a branch covered by the unit suite and one covered by the integration suite both read "1 of 2" and a naive merge under-reports. The JSON keeps each branch as its own record with a hit count, so the merge is exact. This is written up in docs/development/testing.md §3.4.

Tests

• Auth — the rejection paths (unknown, expired and replayed refresh tokens, deactivated accounts, logout against a token the caller does not own), the already-linked and orphaned Google sign-in branches, and the concurrent-insert race that has to surface as 409 rather than 500.
• Domain — every entity guard, including that Revoke keeps the first reason and that Activate does not rotate the security stamp.
• Todos and categories — ownership isolation, filters, search, ordering, and the concurrency conflict where the row is deleted between the read and the write.
• Infrastructure — the Pwned Passwords range lookup against a stub handler (k-anonymity, match, threshold, malformed lines, every fail-open path), the current-user claims reader, the hasher's malformed-hash paths, and provider selection in the composition root.
• WebApi — each arm of the exception-to-problem mapping, the refresh cookie and its CSRF check, the JWT signing-key guard, and the app hosted as Production and with no appsettings at all.

Source changes

Two, both to make untested behaviour testable. No behaviour change either time.

• GoogleTokenValidator — the payload mapping is split into FromPayload so it can be tested without Google's live signing keys.
• Program.cs — the startup database initialisation and its background retry loop move to a new DatabaseStartup, which returns the retry task rather than discarding it internally. Program.cs still discards it, so startup does not wait; the retry delay and attempt count are now explicit at the call site. That is 31 lines of recovery logic that previously had no test at all.

What is not covered

Two lines, both needing a live cloud service:

Location	Why
GoogleTokenValidator.ValidateAsync — the mapping after a successful validation	Verifying a real Google ID token requires Google's live signing keys. The mapping itself is tested via FromPayload; the configuration guard and the malformed-token path are tested too.
Program.cs — the closing brace of the Key Vault block	Only reached when AddAzureKeyVault succeeds against a real vault. The opt-in branch is covered both ways, including that a malformed KeyVault:Uri stops startup.

Verification

dotnet test TodoApp.sln on .NET 10 — 212 unit + 77 integration, 0 failures, in Debug and Release (this repo builds with TreatWarningsAsErrors).

🤖 Generated with Claude Code

https://claude.ai/code/session_019h7znwAftvs36vD4YwKMRf

---

Generated by Claude Code