test: raise line coverage from 66% to 96%

[hjemmel]

Summary

Tests only — no production code was changed (git diff master --stat touches nothing under src/).

Metric	Before	After
Classes	38.88% (7/18)	77.77% (14/18)
Methods	62.96% (34/54)	92.59% (50/54)
Lines	66.66% (156/234)	95.72% (224/234)
Tests	38	84
Assertions	100	195

What's newly covered

HttpErrorHandler 0% → 100% — all six HttpException subtypes via a data provider, the generic-exception path, and both displayErrorDetails branches. Includes an assertion that internal details never leak when the flag is off.

DatabaseWrapper 0% → 100% — this is the class I'd previously said would need the Firebase emulator. That was wrong. Reference and ApiClient are final and unmockable, but ApiClient's constructor takes Guzzle's ClientInterface, and Kreait\Firebase\Database is publicly constructible. So the tests drive the real SDK stack against a Guzzle MockHandler with canned HTTP responses — no emulator, no live database, fully deterministic, and it runs in CI. Covers the HTTP verb and request body for each operation plus the null-key guard in push().

ShutdownHandler 0% → 89%, ResponseEmitter 0% → 100% — message formatting per error type, asserted through the emitted JSON body, plus the buffer-discard path that stops stray output reaching the client. Each runs #[RunInSeparateProcess] since they touch process globals.

Action 80% → 100% — resolveArg's rejection path and the domain-exception-to-HTTP-404 translation, via a minimal concrete subclass.

ActionPayload, ActionError, SessionMiddleware — all to 100%.

The ten lines still uncovered

Each has a concrete reason rather than being an oversight:

Location	Why
ShutdownHandler:57-59	The E_USER_ERROR branch. trigger_error() with E_USER_ERROR halts the process, which would kill the test run.
JsonBodyParserMiddleware:23	Reads php://input directly, always empty under the CLI SAPI.
FirebaseTodoRepository:20-24	The Factory branch needs real Firebase credentials.
InMemoryTodoRepository:33	Xdebug line-attribution artifact — the closing ]; of a multi-line array literal is marked executable but never recorded as hit. Lines 27–32 are covered, so the default array is genuinely constructed. No test can reach it.

Suggested follow-up (not done here)

JsonBodyParserMiddleware reads php://input directly instead of $request->getBody(). Switching to the PSR-7 body would be equivalent in production — Slim populates the request body from php://input anyway — and would make the JSON-parsing path testable. I left it alone since it's a behaviour change to production code and this PR is deliberately tests-only.

🤖 Generated with Claude Code