Refactor: update stale tests and enforce 100% coverage for core logic

[necdetsanli]

Scope (files / modules)

• Test suite under tests/** (unit + integration + e2e)
• Vitest configuration and helpers (if needed)
• Any test utilities/mocks that no longer match current runtime behavior
• Coverage tooling / thresholds (package.json scripts, vitest config)

Exclusions:

• Production runtime code changes unless required to enable proper testability (and even then, keep changes SRP-friendly and minimal)

What is the current problem?

The current tests are stale and were written against an older architecture/behavior:

• Some tests are failing or no longer meaningful because the underlying code and flows changed.
• Coverage is below the level we want for a production-grade app.
• This reduces confidence when making production changes and refactors (especially around /api/reports, admin moderation, and rate limiting).

Proposed refactor

Refresh and strengthen the test suite with a “production-grade confidence” goal:

• Update failing/outdated tests to match the current contracts and behavior.
• Add missing unit/integration tests for core logic and critical paths.
• Establish 100% coverage as a target for core logic layers:
  • src/lib/**
  • src/app/**/_lib/**
• For framework glue code (Next.js route handler wiring), prefer:
  • testing extracted pure functions directly
  • lightweight route-level tests to assert correct integration
• Add/adjust coverage thresholds (statements/branches/functions/lines) and ensure CI enforces them.
• Document any justified exclusions explicitly (ideally none for core logic).

Non-negotiable behavior invariants to test explicitly:

• Honeypot-only validation errors => 200 OK, no DB writes, no rate-limit cost
• Rate limiting semantics and error messages remain stable
• Admin security rules: host allow-list, CSRF token validation, session cookie behavior
• No raw IPs stored; only hashed IP usage in rate limit tables

Behaviour changes

• No behaviour change intended (internal refactor only).
• Behaviour may change slightly (describe below).

Behaviour change details (if any)

N/A. Only test code and coverage configuration should change. If minimal runtime changes are needed purely for testability (e.g. extracting functions), they must not alter runtime behavior.

Planned checks

• npm run lint
• npm run check
• npm run test
• npm run test:coverage
• npm run test:e2e
• npm run verify