Feat sonarqube integration - #185

…ugs found along the way

Investigates SonarQube's 26.8% duplication metric file-by-file against
real duplication data and actual source, sorting every cluster into
safe-to-clean / plannable / do-not-touch tiers. Identifies
whitelistApis.ts (a security authorization table, not copy-pasted
logic) as out of scope, and three files that turn out to be dead code
entirely (never mounted).

No code changes. Also documents six real bugs surfaced as a side
effect of the investigation, none fixed: a DB-retry function that
reports success on failure, a blank state name in a migrated user's
address, an info-level log swallowing OTP failures, a misleadingly-
named shared password constant, and a route that looks up another
user's connections by path parameter.

… myAnalytics.ts, playlist.ts, workallocation.ts

Adds tests for previously-uncovered branches (mostly missing-org and
upstream-failure paths) on files that already had partial coverage
from earlier phases. No existing test was modified or removed.

Real bug found and documented in docs/PROD-VERIFICATION.md, not
fixed: content.ts's POST /getWebModuleManifest has the same
missing-return double-send pattern documented elsewhere in this file.

…s_v2, certifications, bulkUploadUser, emailOrMobileLoginSignIn

Adds tests for previously-uncovered branches on files that already
had partial coverage from earlier phases. No existing test was
modified or removed. Several files reach 97-100% line coverage
(certifications.ts and bulkUploadUser.ts both hit 100%).

Real bug found and documented in docs/PROD-VERIFICATION.md, not
fixed: emailOrMobileLoginSignIn.ts's /registerUserWithMobile has a
third, independent missing-return double-send instance (on a missing
phone field), separate from the already-documented hang bug on the
same route.

Adds a new_coverage-independent condition (fail if overall coverage
drops below 80%) to the "Aastrika Way" gate, now that the Jest
coverage campaign has pushed the absolute figure to 81%. Clean-as-
Code-Code alone only judges lines a PR actually touches, so it can't
by itself stop the whole-repo number from drifting back down.

Applied to the local Sonar server via `npm run sonar:gate`
(idempotent, re-run any time to correct drift). This is the last item
from the original coverage-campaign plan.

…roxyCreator, training, discussionHub/users, nodebbUser

Documents two new findings surfaced while extending tests: profile-registry's
getProfilePageMeta returning unserialized function references instead of
master-data lists, and a SCOPE_CHECK wiring gap that leaves an MDO_ADMIN
restriction on getWorkOrderById inert.

…tnnmcAuthV2, sashaktAuth

Documents a second, independent missing-return double-send in sashaktAuth.ts,
distinct from the already-documented one on the same route.

…p, userDeactivation; add decode.ts tests

roles.ts and details.ts reach 100% line coverage; decode.ts gets its first
test file (was previously untested).

…AutoLogin, OrgForm, V2)

Documents a low-priority, not-currently-exploitable missing-return in
signupWithAutoLoginV2's /register, same bug class as prior double-send
findings but inert under the current implementation.

…hile reviewing Sonar security hotspots

POST_ASSESSMENT_BASE falls back to a real external domain (localhost.com,
not the loopback host); NETWORK_SERVICE_BACKEND's fallback is a malformed
URL missing the scheme separator. Documentation only, no source change.