QA: measure and dramatically raise test coverage to meet devops delivery-policy standards #30

Operator-requested workstream (2026-07-21). The tuvens-devops delivery policy (policy/delivery-policy.json, label-vocabulary automation:p0) requires deterministic validation plus independent Review and QA lanes for the production loop. This repo cannot currently demonstrate deterministic validation: coverage is unmeasured (CI runs phpunit with coverage: none) and the frontend has zero test infrastructure.

Baseline (assessed 2026-07-21)

• Backend: 21 test files vs 933 app files; ~435 unit tests + ~30 feature tests (concentrated in tests/Unit/Services, tests/Feature/Auth, tests/Feature/Tuvens). Most Actions, Handlers, and Repositories untested — one untested path (organizer-settings) shipped a 500 caught only during integration work.
• Frontend: no test runner, no tests. Verification = build + typecheck.
• CI: .github/workflows/unit-tests.yml, coverage: none, no thresholds.

Phased plan (each phase a reviewable PR)

1. Measure first: enable Xdebug/pcov coverage in CI, publish the baseline % as a job artifact/summary, add a ratchet (fail if coverage drops below baseline; raise the floor as suites land).
2. Backend feature-test sweep of the HTTP surface: one feature test per route group (events, products, orders, organizers, webhooks, auth) — highest defect-catch rate per test, exercises handlers/repositories transitively.
3. Unit tests for domain handlers/services with branching logic (status transitions, mapping/provisioning, webhook dispatch filtering).
4. Frontend test infrastructure: vitest + testing-library; start with the auth routes (CrossAppAuth fragment handling), CreateEventModal, EventDashboard conditional rendering (tuvens back-link).
5. QA-lane fit: document the deterministic validation commands per delivery-policy so the independent QA lane can re-run them exact-head.

Tuvens-integration surface is already covered (~29 tests across SecureCrossAppAuthServiceTest / CrossAppAuthenticationTest / TuvensInternalApiTest, PRs #22/#27/#28) — the gap is the pre-existing application code.