chore: modernize dependencies and add Docker dev/test environment

[hjemmel]

Summary

This branch started from an in-flight upgrade that was sitting uncommitted in the working tree and had never been run — kreait/firebase-php 7→8, PHPUnit 12.5, PHP 8.4 in CI, plus a rewrite of the Firebase persistence layer. The first job was proving it actually worked; then bringing the rest of the tooling current.

Everything here was built and verified inside Docker.

Dependencies

	Before	After
phpunit/phpunit	12.5.33	13.3.0
actions/checkout	v5	v7
actions/cache	v4	v6

kreait/firebase-php 8.4.0, slim/slim 4.15.2, php-di 7.1.1, monolog 3.10.0 and slim/psr7 1.8.0 were already current — composer outdated --direct now reports nothing.

The firebase-php 7→8 move reworks the persistence layer so FirebaseTodoRepository talks to a narrow DatabaseInterface (getValue/exists/push/update/remove) instead of passing Firebase Reference objects around. DatabaseWrapper::push() guards the getKey(): ?string null case explicitly.

Docker

• New Dockerfile: PHP 8.4 + Composer 2 + Xdebug, pinned to xdebug.mode=coverage so the container never stalls waiting for an IDE.
• docker-compose.yml: dropped the obsolete version: '3.7' key, added a one-shot cli service.

docker compose up slim -d                    # server on :8080
docker compose run --rm cli composer test    # tests

Test fixes surfaced by PHPUnit 13

All in FirebaseTodoRepositoryTest.php — 7 deprecations + 1 notice, now zero:

• ->method()->with() without expects() is removed in PHPUnit 14. Added explicit expects($this->once()) to all seven. Each is genuinely a single-call path, so this tightens the assertions rather than just silencing the warning (95 → 100 assertions).
• The expectation-less mock in testCreateTodoEmptyName became expects($this->never())->method('push'), which now actually asserts that name validation runs before any database write.

Verification

Clean-room run in the container:

• composer validate --strict ✅
• rm -rf vendor + fresh composer install ✅
• composer audit → no security advisories ✅ (GitHub currently reports 17 Dependabot alerts on master)
• 38 tests / 100 assertions, zero deprecations or notices ✅
• Cobertura coverage generates — the exact CI path ✅
• Server boots: / → 200, /nope → 404 ✅

/todos returns 500 without a public/firebase-key.json, which is expected and is a missing-credentials error, not an API break. Since DatabaseWrapper is the one class the tests never touch (Kreait\Firebase\Database\Reference is final and can't be mocked), I confirmed the v8 API surface by reflection instead: Factory::withServiceAccount/withDatabaseUri/createDatabase, Contract\Database, Reference::push/getKey.

Follow-ups not included here

1. Leaked credential in app/settings.php — a hardcoded Firebase database URL and secret key, committed and in git history. Nothing reads settings['firebase'], so it is dead config. Left untouched deliberately rather than silently changing a secret; recommend deleting it and rotating the key.
2. DatabaseWrapper has no test coverage — covering it needs an integration test against the Firebase emulator, since Reference is final.

🤖 Generated with Claude Code